What does the following search do? index=corndog type= mysterymeat action=eaten | stats count as corndog_count by user

Question

Options

• ACreates a table of the total count of users and split by corndogs.
• BCreates a table of the total count of mysterymeat corndogs split by user.
• CCreates a table with the count of all types of corndogs eaten split by user.
• DCreates a table that groups the total number of users by vegetarian corndogs.

• A
  2% (1)
• B
  86% (55)
• C
  9% (6)
• D
  3% (2)

Explanation

The search filters events from the 'corndog' index where type=mysterymeat and action=eaten. The pipe then passes those filtered events to the stats command, which counts them and renames the count field to corndog_count, grouped by user. The result is a table showing how many mysterymeat corndogs were eaten by each user. The specific filters on type and action mean it is not counting all corndog types - only 'mysterymeat' corndogs with an 'eaten' action.

No community discussion yet for this question.