Data coverage and freshness
malcolm_data_coverageRead-only
Summarize existing data: live sensors, newest data age, per-dataset document volumes, and index count. Use before hunting to verify which sensors are active and how fresh their data is.
Instructions
Summarize what data exists: feeding sensors, freshness, and per-dataset volume.
Use this before a hunt to see which sensors are live, how stale the newest data
is (latest_age_seconds), document counts per event.dataset (conn, dns, ssl,
alert, ...), and index count. For overall service/stack health rather than data
volume, use malcolm_service_status. For distinct values of one arbitrary field
rather than the dataset breakdown, use malcolm_field_values. Returns a JSON
summary; each sub-section reports its own error key on failure instead of
aborting, unless every one of them fails, which raises.
The time range scopes the per-dataset counts ONLY — sensor liveness,
latest_age_seconds and the index count come from endpoints that take no
range at all. So a narrow window cannot make a live sensor look dead,
but it will make a busy dataset look empty.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| time_to | No | End time for the per-dataset counts, dateparser format. Empty = now. | |
| time_from | No | Start time for the per-dataset counts, dateparser format. Empty = the last 24 hours; sensor liveness and the index count ignore this argument. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |