List unique values of one field
arkime_uniqueRead-only
List distinct values of a single Arkime field as plain text, with optional counts. Use when you need to see what values a field holds without a full aggregation.
Instructions
List distinct values of ONE Arkime field as plain text, optionally with counts.
For distinct value COMBINATIONS across a tuple of fields use
arkime_multiunique; for top values of one field plus a time-series graph
use arkime_spigraph; to profile many fields in one call use
arkime_spiview. Lighter than a full aggregation when you only need to see
what values a field holds.
Returns plain TEXT (one value per line, not JSON) — Arkime streams it
directly. "(no values)" has TWO causes and this route cannot tell them
apart: the window holds nothing, or the field name does not resolve.
Measured on Malcolm v26.07.1, field="nosuch.field" over a window with
6M sessions answers HTTP 200 with a zero-byte body, exactly like a
genuinely empty result — where every sibling is loud (arkime_multiunique
says "Unknown expression", arkime_spigraphhierarchy answers 403,
arkime_sessions_summary lists the name in ignored_fields). So check the
spelling against arkime_field_search's exp column before assuming the
window is wrong; only then pass time_from.
A wide field is truncated silently at Arkime's aggregation ceiling of
10,000 values, with no marker and no error: measured on Malcolm v26.07.1, one
port field returned exactly 10,000 lines over a window that held 16,005
distinct values. Treat a round 10,000 as "there are more", and scope
with expression rather than reading it as the whole value set.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | One Arkime field expression, e.g. "ip.dst", "protocols", "http.host". | |
| counts | No | Include a per-value occurrence count (default true). Turning it off cuts about a third of the characters (measured on v26.07.1: 91,033 down to 59,931 for one field over a 24-hour window) and is the right choice when you only need the value set itself — to paste into arkime_create_shortcut, for instance. | |
| time_to | No | End time as EPOCH SECONDS (NOT a dateparser string). Empty = now. | |
| time_from | No | Start time as EPOCH SECONDS (NOT a dateparser string). Empty = Arkime's default recent window, which finds nothing in a capture older than it — pass a range to reach historical data. | |
| expression | No | Optional Arkime expression syntax to scope the values, e.g. "protocols==dns". Empty = all sessions. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |