Stats count on list of values from lookup and how many times they are displayed in the results.

[ajinaqvi]

I am currently running a dashboard with a datamodel. The dashboard is run against bulk IOCs from a lookup. How can I put up a panel in a dashboard that will display the list of IOCs and count of IOCs in results?

[king2jd]

Without seeing your field names, I am taking a shot in the dark. I imagine it would be something like this:

lookup command|stats count by IOC

Too add up the total counts of all IOC's , use. |addcoltotals at the end of your search.

-Jordan

[ajinaqvi]

Will this provide stats count on how many times an IOC is found when running against an index or data model?