What is the correct syntax to count the number of events containing a vendor_action field?

What is the correct syntax to count the number of events containing a vendor_action field?
A . count stats vendor_action
B . count stats (vendor_action)
C . stats count (vendor_action)
D . stats vendor_action (count)

View Answer

Answer: C

Explanation:

The stats command calculates statistics based on fields in the events. The count function counts the number of events that match the criteria. The syntax is stats count (field_name), where field_name is the name of the field that contains the value to be counted. In this case, vendor_action is the field name, so stats count (vendor_action) is the correct syntax.

Reference: Splunk Core User Certification Exam Study Guide, page 23.