viewer9 documentation

Query Distinct Values

The distinct d specifier is used to discover the unique values of a field or combination of fields, and count occurrences of those values. Values are listed in order of occurrence (sorting is not yet supported). For example, show different values for ResultCode:

q d ResultCode

That lists distinct ResultCode values for all events in the capture file. To show distinct ResultCode values for CreateFile operations of process 6, the distinct clause goes at the end after the other criteria:

q proc=6 Op=CreateFile d ResultCode

countResultCode
94SUCCESS
48NAME NOT FOUND
43PATH NOT FOUND

Criteria for the distinct fields can optionally be given in the distinct field list itself. For example, find distinct ResultCode containing the word buffer:

q d ResultCode:buffer

countResultCode
20043BUFFER OVERFLOW
144BUFFER TOO SMALL

That could also be expressed with the criteria before the d specifier:

q ResultCode:buffer d ResultCode

Queries are not case sensitive, so Path:a is equivalent to Path:A. But matches with different cases are considered to be distinct, so C:\a is distinct from c:\a is distinct from C:\A. Show the variations (in upper and lower case) of how the Drivers32 key is expressed:

q d Path=HKLM*Drivers32

countPath
1HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32
1HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32
195HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32

With multiple fields it will count the combinations. For example, show the unique combinations of ProcIntegrity and ProcAuthId:

q d ProcIntegrity ProcAuthId

countProcIntegrityProcAuthId
2High00000000:00016fae
11Medium00000000:00016fec
100000000:00000000
22System00000000:000003e7
4System00000000:000003e4
6System00000000:000003e5
1System00000000:000115b2
1High00000000:00016fec
62Low00000000:00016fec
3Untrusted00000000:00016fec

In addition to multiple fields, there can be a nested distinct clause. The nested distinct clause will count unique values "inside" each distinct value in the first clause. Compare these results to the query above:

q d ProcIntegrity d ProcAuthId

countProcIntegritynested
3High2
11Medium1
11
33System4
62Low1
3Untrusted1

See also

Posted 16 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.