List field values
malcolm_field_valuesRead-only
List distinct values for a field with per-value document counts to see actual data before filtering.
Instructions
List a single field's distinct VALUES with per-value document counts.
Use this to see what values a field actually holds before filtering on it, so
you don't invent values. To confirm the field NAME exists first, use
malcolm_field_search; to see which datasets carry the field, use
malcolm_field_profile. For multi-field or nested bucketing, use
malcolm_aggregate. A "-" in the output is Malcolm's placeholder for
documents where the field is absent, not a value you can filter on.
Returns a text list of "value (N docs)" lines.
With no time range this reads only the last 24 hours, so a value that
exists only in older data is missing here and reads as invalid —
measured on Malcolm v26.07.1, network.protocol lists nothing at the
default window while its top value carries millions of documents once
time_from reaches the capture. Pass time_from before concluding a value
is not in this Malcolm.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | Yes | Field to enumerate distinct values for, e.g. "event.dataset" -> ["conn","dns","ssl",...]; "network.protocol" -> ["tcp","udp","icmp"]; "suricata.alert.severity" -> [1,2,3]. Confirm the name with malcolm_field_search. | |
| limit | No | Max distinct values to return, ordered by document count. | |
| filters | No | Optional JSON filter (Malcolm filter syntax) scoping the enumeration. Empty = all documents. | {} |
| time_to | No | End time, dateparser format. Empty = now. | |
| time_from | No | Start time, dateparser format. Empty = the last 24 hours, which holds nothing on a capture older than that. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |