1. A computer-implemented method, comprising: employing at least one processor configured to execute computer-executable instructions stored in memory to perform the following acts: receiving a diagnostic event stream associated with a software application, wherein each event in the diagnostic event stream comprises an attribute and value of the attribute; identifying one or more unique values of the attribute from the diagnostic event stream, wherein the one or more unique values are non-duplicative; determining a count of the unique values; assigning the attribute to one of a plurality of categories based on variance in the count and one or more past counts of unique values; and presenting, on a display, the attribute based on the one of the plurality of categories assigned and generating at least one query suggestion based on the assignment of the attribute to the one of a plurality of categories for presentation on the display, the at least on query suggestion being associated with performance of diagnostics of the software application.