Build nested field hierarchy
arkime_spigraphhierarchyRead-only
Build a nested top-N hierarchy across Arkime fields for drill-down analysis, returning a treemap structure with counts per level.
Instructions
Build a nested top-N hierarchy across Arkime fields (a treemap / drill-down).
Returns a nested hierarchy (level 1 -> its top level-2 values -> ...),
matching Arkime's SPI-graph hierarchy view. Unlike malcolm_aggregate's
flat multi-field buckets and arkime_multiunique's flat tuple list, the
result is nested. For a single field plus a time graph use
arkime_spigraph; for a source/destination graph use arkime_connections.
Returns the raw Arkime spigraph-hierarchy response (nested value tree).
Level 1 is the outermost, and every deeper level's top values are
counted inside their own parent rather than globally, so a value that
is common overall can be missing from a branch where it is rare. Each
level keeps Arkime's top 20 and this tool does not expose that number:
measured on Malcolm v26.07.1, a two-level tree returned 20 first-level values
out of the 112 the window held, each parent carrying a different number
of children. An empty tree with no time range usually means the data
predates Arkime's default recent window: pass time_from.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | Yes | Comma-separated Arkime fields defining the hierarchy levels in order, e.g. "source.ip,destination.ip,destination.port". | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |