I am currently running a dashboard with a datamodel. The dashboard is run against bulk IOCs from a lookup. How can I put up a panel in a dashboard that will display the list of IOCs and count of IOCs in results?
Without seeing your field names, I am taking a shot in the dark. I imagine it would be something like this:
lookup command|stats count by IOC
Too add up the total counts of all IOC's , use. |addcoltotals at the end of your search.
-Jordan
Will this provide stats count on how many times an IOC is found when running against an index or data model?
