List saved Arkime views
arkime_viewsList saved Arkime search views and their expressions to reuse existing investigative queries before crafting new ones.
Instructions
List the saved search views this Arkime holds, with each one's expression.
Use this to find the queries the human team already curated before
writing your own — a view names an investigation someone thought worth
keeping. Take a view's `expression` and pass it to arkime_sessions to
run it. For named value lists (IOC sets) rather than saved queries, use
arkime_shortcuts; to discover field names for a new expression, use
arkime_field_search; to add one of your own use arkime_create_view
(needs the arkime-view write class), and it lands in this same list.
Views are per-user and per-role, so this shows what the configured
account can see, not everything on the server: measured on Malcolm
v26.07.1, every view returned carries an `owner` and a `roles` list, and
all of them named the one account this server authenticates as. Field
meanings are in the output schema.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max views to return. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |