Heres a way to do it if you have a large number of hosts that match a regex without using a lookup file:
|stats count | eval [|metadata type=hosts |regex host="<matching hosts>"| fields + host | mvcombine delim="," host | nomv host | format "","","","","",""] | makemv delim="," host | mvexpand host | append [search sourcetype="wineventlog:security" | regex host="<matching hosts>" ] | stats sum(eval(if(isnull(_time),0,1))) as count by host
... View more