arkime_unique
List distinct values of an Arkime field with optional counts. Quickly identify unique field values without running a full aggregation.
Instructions
List distinct values of one Arkime field, with optional counts.
Lighter than a full aggregation when you only need to see what values a field holds. Returns one value per line (Arkime streams plain text).
Args: field: Arkime field expression, e.g. "ip.dst", "protocols". expression: Optional Arkime filter to scope the values. counts: Include a per-value count (default true).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | ||
| counts | No | ||
| expression | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |