Querying Objects

Events are not the only thing that can be queried. There are also exes, processes (procs), modules (mods), and capture files (caps). Unlike event fields, fields for these other types of objects are prefixed with Exe Proc Mod or Cap to make it clear which type of object they pertain to.

By default the object type in the results will depend on the fields of the query. So querying an exe field such as ExePath will show exes. For example, all the exes of the AVAST software might be selected by using the parent folder name q ExePath:\avast\. Notice in these results, a couple of the exes have (2) in parentheses after their names which means those exes each have two processes.

If fields of multiple object types appear in one query, viewer9 will display the most granular of them by default. So querying an event field with any other object field will display events. Querying a module field with an exe and/or proc field will display modules. Querying a process field with an exe field will display processes. Querying a capture field with any other object field will search for the other type of object in matching capture files. But event criteria will not narrow the set of matching objects, i.e. you cannot select just those processes that read a certain file -- you can only see the matching events in that case.

In some cases object specifiers events exes procs mods caps can be used to get results of a different object type than the default. To get all events belonging to any of the exes selected above, enter q events ExePath:\avast\.

If a query without any Cap fields is entered while viewing a capture file, it will by default only query that capture file. But if you are not viewing a specific capture file or the query contains a Cap field or caps specifier, then the result will be a list of matching capture files from the current directory and its subdirectories. If the query has only Cap fields then the results will be a table of capture files, otherwise each capture file will have a table of up to 10 matches within it:

See also

• Query Syntax
• Query Distinct Values
• Filesystem View