What is the correct syntax to count the number of events containing a vendor_action field?

Question

Options

• Acount stats vendor_action
• Bcount stats (vendor_action)
• Cstats count (vendor_action)
• Dstats vendor_action (count)

• A
  6% (3)
• B
  2% (1)
• C
  89% (42)
• D
  2% (1)

Explanation

The correct SPL syntax for counting events that contain a specific field is: stats count(vendor_action). The stats command must come first, followed by the function and its argument. count(vendor_action) specifically counts only the events where the vendor_action field exists (is non-null), as opposed to count with no argument, which counts all events. Options A and B reverse the command order, and D uses invalid syntax with the field before the function.

No community discussion yet for this question.