Most of the examples I've seen (still learning) use count like so:
| stats count(src_ip) as IP
but I occasionally find an example like this:
| stats count
or
| stats count as IP
Why and when would you use count without a field name? How does it even work, that is, how does it know what field to count?
I've searched the documentation and can't find any explanation for the different formats.
... View more