Profile many fields at once
arkime_spiviewRead-only
Profile top values across several Arkime fields in a single call, returning each field's top values with counts and sum_other_doc_count for missing distribution.
Instructions
Profile top values across SEVERAL Arkime fields at once, each with counts.
One call covers many fields — lighter than running one aggregation per
field. For a single field use arkime_unique (plain text) or
arkime_spigraph (adds a time graph); for distinct field-tuple
combinations use arkime_multiunique; for a nested drill-down hierarchy
use arkime_spigraphhierarchy. Returns the raw Arkime spiview response
(per-field top values with counts).
Each field also reports sum_other_doc_count, the sessions its listed
values do not account for; a large one means the top-N hid most of the
distribution.
A field always comes back under its own key, with an empty bucket list
and HTTP 200 when nothing aggregated, so the key's presence proves
nothing. `recordsFiltered` is what separates the two causes: it counts
the sessions the expression and window matched, before any field is
aggregated. Measured on Malcolm v26.07.1, spi=protocols:10 over a window
holding data returned 0 buckets with recordsFiltered 6,016,935, while
spi=protocol:10 with no time range returned 0 buckets with
recordsFiltered 0. A non-zero recordsFiltered under empty buckets means
that FIELD NAME did not resolve; only recordsFiltered 0 is a time-range
problem, fixed by passing time_from.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| spi | Yes | Comma-separated Arkime fields named by their STORAGE PATH, each optionally suffixed ":<count>" to cap its values, e.g. "protocol:10,destination.ip:20,http.host" — the same spelling arkime_spigraph's field takes. NOT the exp column: measured on v26.07.1 over one 24-hour window, spi=protocol:10 returned 10 buckets, spi=destination.ip:20 returned 20 and spi=http.host:5 returned 5, while spi=protocols:10, spi=ip.dst:20 and spi=dstIp:20 each returned an empty bucket list under HTTP 200. For the seventeen fields whose db column is a camelCase alias, pass the dotted storage path instead (source.ip for srcIp, destination.port for dstPort). A field left without the suffix takes Arkime's own default of 10 values, not all of them: spi=protocol:10 returned 10 of that field's 52 values (spi=protocol:1000 returns all 52) and swept the remaining 139,902 sessions into sum_other_doc_count. Pass a count whenever you need a known depth. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |