| viewer9 documentation | Index Home |
Query Distinct Values
The distinct d specifier is used to discover the unique values of a field or combination of fields, and count occurrences of those values. Values are listed in order of occurrence (sorting is not yet supported). For example, show different values for ResultCode:
q d ResultCode
That lists distinct ResultCode values for all events in the capture file. To show distinct ResultCode values for CreateFile operations of process 6, the distinct clause goes at the end after the other criteria:
q proc=6 Op=CreateFile d ResultCode
| count | ResultCode |
|---|---|
| 94 | SUCCESS |
| 48 | NAME NOT FOUND |
| 43 | PATH NOT FOUND |
Criteria for the distinct fields can optionally be given in the distinct field list itself. For example, find distinct ResultCode containing the word buffer:
q d ResultCode:buffer
| count | ResultCode |
|---|---|
| 20043 | BUFFER OVERFLOW |
| 144 | BUFFER TOO SMALL |
That could also be expressed with the criteria before the d specifier:
q ResultCode:buffer d ResultCode
Queries are not case sensitive, so Path:a is equivalent to Path:A. But matches with different cases are considered to be distinct, so C:\a is distinct from c:\a is distinct from C:\A. Show the variations (in upper and lower case) of how the Drivers32 key is expressed:
q d Path=HKLM*Drivers32
| count | Path |
|---|---|
| 1 | HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32 |
| 1 | HKLM\Software\Microsoft\Windows NT\CurrentVersion\Drivers32 |
| 195 | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 |
With multiple fields it will count the combinations. For example, show the unique combinations of ProcIntegrity and ProcAuthId:
q d ProcIntegrity ProcAuthId
| count | ProcIntegrity | ProcAuthId |
|---|---|---|
| 2 | High | 00000000:00016fae |
| 11 | Medium | 00000000:00016fec |
| 1 | 00000000:00000000 | |
| 22 | System | 00000000:000003e7 |
| 4 | System | 00000000:000003e4 |
| 6 | System | 00000000:000003e5 |
| 1 | System | 00000000:000115b2 |
| 1 | High | 00000000:00016fec |
| 62 | Low | 00000000:00016fec |
| 3 | Untrusted | 00000000:00016fec |
In addition to multiple fields, there can be a nested distinct clause. The nested distinct clause will count unique values "inside" each distinct value in the first clause. Compare these results to the query above:
q d ProcIntegrity d ProcAuthId
| count | ProcIntegrity | nested |
|---|---|---|
| 3 | High | 2 |
| 11 | Medium | 1 |
| 1 | 1 | |
| 33 | System | 4 |
| 62 | Low | 1 |
| 3 | Untrusted | 1 |
See also
Posted 16 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.