Splunk Core Certified User — Question 92

What is the correct syntax to count the number of events containing a vendor_action field?

Answer options

• A. count stats vendor_action
• B. count stats (vendor_action)
• C. stats count (vendor_action)
• D. stats vendor_action (count)

Correct answer: C

Explanation

The correct answer is C, as it properly uses the 'stats' command to count the occurrences of the vendor_action field. Options A and B incorrectly use 'count' in a way that does not align with Splunk's syntax. Option D misplaces the count function, making it invalid.