@lucy2019first, your search request contains typo in "action" field sourcetype=abcd user=john ation=login and I'm not sure but the mistake seems to be what you use stats count(action) after table without action field. Did you check the request in a regular search?
... View more