A hunting query must estimate the number of unique affected devices rather than count all events. Which aggregation is appropriate?

1. sum(DeviceId)
2. count()
3. max(Timestamp)
4. dcount(DeviceId)