count hits for a query without exporting data
[-h | -? | --help] prints the help text
[--disable-taxonomies] don't substitute taxonomy identifiers
[-e | --estimate] estimate an upper bound by skipping candidate checks


The count command counts the number of events that a given query expression yields. For example:

vast count ':addr in'

This prints the number of events in the database that have an address field in the subnet

An optional --estimate flag skips the candidate checks, i.e., asks only the index and does not verify the hits against the database. This is a faster operation and useful when an upper bound suffices.