Sessions
Get Unique Field Values
Returns unique values for a session field as a CSV download, optionally with counts. Useful for extracting distinct IPs, ports, or other field values matching a query.
get/v3/sessions/unique
Query parameters
scope'workspace' | 'demo'
Controls the data scope for the query.
- workspace: Query data from the current workspace (default). Requires the Sensors entitlement.
- demo: Query demo/sample data. Requires the Swarm entitlement. Not available on export endpoints.
start_timestring date-time required
Start time for the query range (ISO 8601 format).
end_timestring date-time required
End time for the query range (ISO 8601 format).
fieldstring required
Field to get unique values for.
querystring
Lucene query string to filter sessions.
include_counts'true' | 'false'
Whether to include counts in the output.
Response
CSV file with unique values.