A 'counting question' in Tanium returns results that:

In Tanium, a 'counting question' is designed to aggregate and summarize information based on the responses from endpoints. When you pose a counting question, the results show the number of endpoints that provide the same answer, effectively helping users assess the distribution of certain attributes or values across their environment.

This capability is vital for administrators who need to identify how many systems fall into various categories or configurations. The aggregation feature allows for intuitive analysis of data trends, making it easier to manage and secure the network by visualizing how many endpoints share certain characteristics, such as specific software versions or compliance statuses.