What does ioc map to in your indexed data? Is it query? What's domain? Have you tried
index=* sourcetype=* [|inputlookup ioc.csv |rename ioc as query|fields query]|stats count by query
Can you provide details on your indexed data you want to include in your search?
... View more