What other syntax will produce exactly the same results as | chart count over vendor_action by user?
| chart count by vendor_action, user
| chart count over vendor_action, user
| chart count by vendor_action over user
| chart count over user by vendor_action
https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Chart
Submit