for ip in ips:
query = f'search "{ip}" earliest=-1d index=main | stats count by index'
What is the point of generating 500 searches anyway (and returning possibly huge lists of results for each one).
ignore this question -- **kwargs count fixed the issue.