When you use count/dc/estdc in a search, does it always count from a field? For example, is: count(foo) counting the instances of the field foo?
Yes, count(foo) will count the number of events where field foo has values (it's not null).
Ok that really does help. So does (foo in this case) HAVE to be a field? Or can it be an object within a datamodel/something other than a field?
It would always be a field available in event. If the events are selected from a datamodel, the this would be a field in that datamodel (DatamodelNodeName.fieldname or similar hierarchy).
