> For the complete documentation index, see [llms.txt](https://digitalgarden.batamladen.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://digitalgarden.batamladen.com/notes/query-languages/kql/distinct-or-count-or-sort-or-order.md).

# distinct | count | sort | order

### sort by

sort command returns our query in order based on the field of interest that we specify.\
We can specify if we want and asc or desc order.

The order is defined by the type of value contained in the field, but if there are numbers and letter if we sort in ascending order we will get results starting from '0' and going to letter 'z'

FunFact: capital letters are odered before small letters in ascending order.

***

### order by

This is the same as sort by just different syntax for people comming from SQL.

***

### distinct

Helps us find unique values in any field.

```
cluster('help').database('SecurityLogs').ProcessEvents
| where parent_process_name == 'excel.exe'
| distinct parent_process_name
```

result:

```
CMD.exe
cmd.exe
sc.exe
explorer.exe
conhost.exe
```

***

### count

Returns the number of rows as a result.

```
cluster('help').database('SecurityLogs').ProcessEvents
| where parent_process_name == 'excel.exe'
| distinct parent_process_name
| count
```

result:

```
5
```

***

### Homework

from the help cluster, the SecurityLog database, Employees table, sort the table by role name, from A-Z


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://digitalgarden.batamladen.com/notes/query-languages/kql/distinct-or-count-or-sort-or-order.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.