Build nested field hierarchy
arkime_spigraphhierarchyRead-only
Build a nested top-N hierarchy across Arkime fields for treemap drill-down analysis. Returns a nested value tree matching the SPI-graph hierarchy view.
Instructions
Build a nested top-N hierarchy across Arkime fields (a treemap / drill-down).
Returns a nested hierarchy (level 1 -> its top level-2 values -> ...),
matching Arkime's SPI-graph hierarchy view. Unlike malcolm_aggregate's
flat multi-field buckets and arkime_multiunique's flat tuple list, the
result is nested. For a single field plus a time graph use
arkime_spigraph; for a source/destination graph use arkime_connections.
Returns the raw Arkime spigraph-hierarchy response (nested value tree).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | Yes | Comma-separated Arkime fields defining the hierarchy levels in order, e.g. "source.ip,destination.ip,destination.port". | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |