Profile many fields at once
arkime_spiviewRead-only
Profile top values across several Arkime fields in one call, with per-field counts, to compare distributions without running separate aggregations.
Instructions
Profile top values across SEVERAL Arkime fields at once, each with counts.
One call covers many fields — lighter than running one aggregation per
field. For a single field use arkime_unique (plain text) or
arkime_spigraph (adds a time graph); for distinct field-tuple
combinations use arkime_multiunique; for a nested drill-down hierarchy
use arkime_spigraphhierarchy. Returns the raw Arkime spiview response
(per-field top values with counts).
Each field also reports sum_other_doc_count, the sessions its listed
values do not account for; a large one means the top-N hid most of the
distribution.
A field always comes back under its own key, with an empty bucket list
and HTTP 200 when nothing aggregated, so the key's presence proves
nothing. `recordsFiltered` is what separates the two causes: it counts
the sessions the expression and window matched, before any field is
aggregated. spi=protocols:10 over a window holding data returns 0
buckets with a non-zero recordsFiltered, while spi=protocol:10 with no
time range can return 0 buckets with recordsFiltered 0. A non-zero
recordsFiltered under empty buckets means
that FIELD NAME did not resolve; only recordsFiltered 0 is a time-range
problem, fixed by passing time_from.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| spi | Yes | Comma-separated Arkime fields named by their STORAGE PATH, each optionally suffixed ":<count>" to cap its values, e.g. "protocol:10,destination.ip:20,http.host" — the same spelling arkime_spigraph's field takes. NOT the exp column: spi=protocol:10, spi=destination.ip:20 and spi=http.host:5 fill their buckets, while spi=protocols:10, spi=ip.dst:20 and spi=dstIp:20 each return an empty bucket list under HTTP 200. For the few fields whose db column is a camelCase alias, pass the dotted storage path instead (source.ip for srcIp, destination.port for dstPort). A field left without the suffix takes Arkime's own default of 10 values, not all of them, and the sessions behind the rest are swept into sum_other_doc_count. Pass a count whenever you need a known depth. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's recent-only default. | |
| expression | No | Optional Arkime expression syntax to scope the data. Empty = all sessions. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |