Here is a view of that side panel from a recent search. Notice it has been renamed to aggregations in the current UI. Below are the fields metadata.product_name and metadata.event_type. In our result set, we have 143 events and each of these fields has a value in every event, so the value on the far right is 143. Within the parenthesis, we can see that there are 5 distinct values for product name and 4 for event_type.
When I expand the field, I see the 5 values for metadata.product_name and the 4 details for metadata.event_type within. In this case Office 365 is one of those 5 distinct values and 11 events are of that product_name and 19 of the 143 event_types is USER_LOGIN.
As I mentioned eariler, not all events will have a field populated. Here we have the target.application field which is only populated in 24 of the 143 events in our search. Of those 24 events, there are 7 distinct applications and the AzureActiveDirectory value is seen 10 times of the 24 times that field is populated.
Hope that helps!
