@gcusello
I have multiple count functions in the same search component. What does it mean by that? What is really happening here?
| stats count(vendor_action) as ActionEvents, count as TotalEvents
I can definitely understand count(vendor_action) as ActionEvents. What is this part count as TotalEvents saying in regards to the first count?
The first count is counting up the events that have a vendor_action field. The second count is counting up the total number of events.
You can use this to calculate a percentage, for example:
| stats count(vendor_action) as ActionEvents, count as TotalEvents
| eval message="Vendor action events account for ".round(ActionEvents/TotalEvents*100,1)."% of the total volume"