How do I run my list of IOC from my lookup table against a web datamodel by using tstats.
I can do the regular IOC lookup table against the indexes and it work perfectly fine, however, it just take a lot of memory.
It would be help if some one knows how to run csv or kv to compare it with datamodel.
for example here is a very basic search i am running
|tstats count from datamodel=Web by Web.url
[| inputlookup http_intel
| fields url
| rename url as Web.url]