--- title: Find the Query That Ran at 3 a.m.: A Wanted Poster description: A SQL Server 2025 demo shows how to find a hidden expensive query using only Query Store. A COUNT_BIG query ran 8 times with different literals, disguising... canonical: https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Find the Query That Ran at 3 a.m.: A Wanted Poster | daily.dev og:description: A SQL Server 2025 demo shows how to find a hidden expensive query using only Query Store. A COUNT_BIG query ran 8 times with different literals, disguising... og:url: https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7 og:image: https://api.daily.dev/og/posts/1Y1sXlVt7.png og:image:alt: Find the Query That Ran at 3 a.m.: A Wanted Poster og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Find the Query That Ran at 3 a.m.: A Wanted Poster **[SQL Authority](https://daily.dev/sources/sql-authority)** · 7 min read · 0 upvotes · 0 comments ## Summary A SQL Server 2025 demo shows how to find a hidden expensive query using only Query Store. A COUNT_BIG query ran 8 times with different literals, disguising itself as 8 separate queries, each scanning 2.5 million rows via a clustered index scan for 41,823 reads, 334,584 total. Grouping by query_hash instead of query_id reveals it as one culprit doing 88 times the reads of 394 other executions combined. Adding a nonclustered index on (Status, Amount) dropped reads per execution to 4,886. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I find a query in SQL Server that ran once with a different literal each time, making it look like separate queries? Group Query Store results by query_hash instead of query_id, since the hash is computed from the statement shape with literals stripped out. Eight executions of a COUNT_BIG statement with different WHERE clause literals shared one query_hash of 0x1E34C17E155296A7, totaling 334,584 logical reads versus 3,819 reads across 394 executions of unrelated queries. _Hunting down disguised queries in SQL Server? Track Query Store techniques like this on daily.dev._ ### Why does the plan cache fail to catch a query that ran once overnight in SQL Server? The plan cache forgets after a restart, memory pressure, or a busy afternoon, so overnight evidence can disappear. Query Store writes execution stats to disk and retains them as long as configured, with a 1,000 MB budget by default, making it the reliable tool for investigating queries that ran while nobody was watching. _Developers debugging overnight SQL Server incidents can keep tabs on techniques like this via daily.dev._ ### How much can a missing index affect reads for a COUNT query on a 2.5 million row SQL Server table? A COUNT_BIG filtered on Amount and Status without a supporting index caused a clustered index scan reading all 2,500,000 rows, costing 41,823 logical reads per execution. Adding a 48 MB nonclustered index on (Status, Amount) let the same query run as an index seek, cutting reads to 4,886. _Weighing whether to add an index for a slow aggregate query? Follow indexing trade-offs like this on daily.dev._ ## Similar posts on daily.dev - [Slow Queries: A Field Guide to Eight Species](https://daily.dev/posts/slow-queries-a-field-guide-to-eight-species-0sf8eayfx) · SQL Authority · 0 upvotes · 0 comments - [The Query Optimizer Interview: Twenty Minutes, No Hints](https://daily.dev/posts/the-query-optimizer-interview-twenty-minutes-no-hints-ownvu4mdx) · SQL Authority · 1 upvotes · 0 comments - [ClickHouse Will Let You Be Wrong at Scale](https://daily.dev/posts/clickhouse-will-let-you-be-wrong-at-scale-prxaelmw6) · Mat Duggan · 1 upvotes · 0 comments --- Tags: [#backend](https://daily.dev/tags/backend), [#microsoft-sql-server](https://daily.dev/tags/microsoft-sql-server) [View this post on daily.dev](https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Find the Query That Ran at 3 a.m.: A Wanted Poster","url":"https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7"},"datePublished":"2026-10-30T08:32:57.414Z","dateModified":"2026-10-30T08:33:30.435Z","description":"A SQL Server 2025 demo shows how to find a hidden expensive query using only Query Store. A COUNT_BIG query ran 8 times with different literals, disguising...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/559a29956131e9edfde49a291d19cc18?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/559a29956131e9edfde49a291d19cc18?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"SQL Authority","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"SQL Authority","logo":"https://media.daily.dev/image/upload/s--reCGnvgi--/f_auto,q_auto/v1780213436/logos/sql-authority?_a=BAMAMiWQ0","url":"https://daily.dev/sources/sql-authority"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"backend,microsoft-sql-server","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"SQL Authority","item":"https://daily.dev/sources/sql-authority"},{"@type":"ListItem","position":3,"name":"Find the Query That Ran at 3 a.m.: A Wanted Poster"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/find-the-query-that-ran-at-3-a-m-a-wanted-poster-1y1sxlvt7#faq","mainEntity":[{"@type":"Question","name":"How do I find a query in SQL Server that ran once with a different literal each time, making it look like separate queries?","acceptedAnswer":{"@type":"Answer","text":"Group Query Store results by query_hash instead of query_id, since the hash is computed from the statement shape with literals stripped out. Eight executions of a COUNT_BIG statement with different WHERE clause literals shared one query_hash of 0x1E34C17E155296A7, totaling 334,584 logical reads versus 3,819 reads across 394 executions of unrelated queries. Hunting down disguised queries in SQL Server? Track Query Store techniques like this on daily.dev."}},{"@type":"Question","name":"Why does the plan cache fail to catch a query that ran once overnight in SQL Server?","acceptedAnswer":{"@type":"Answer","text":"The plan cache forgets after a restart, memory pressure, or a busy afternoon, so overnight evidence can disappear. Query Store writes execution stats to disk and retains them as long as configured, with a 1,000 MB budget by default, making it the reliable tool for investigating queries that ran while nobody was watching. Developers debugging overnight SQL Server incidents can keep tabs on techniques like this via daily.dev."}},{"@type":"Question","name":"How much can a missing index affect reads for a COUNT query on a 2.5 million row SQL Server table?","acceptedAnswer":{"@type":"Answer","text":"A COUNT_BIG filtered on Amount and Status without a supporting index caused a clustered index scan reading all 2,500,000 rows, costing 41,823 logical reads per execution. Adding a 48 MB nonclustered index on (Status, Amount) let the same query run as an index seek, cutting reads to 4,886. Weighing whether to add an index for a slow aggregate query? Follow indexing trade-offs like this on daily.dev."}}]} ```