The interesting part of this search is the lookup!
`autoreg_registrations` | lookup local=t mac2huid mac AS src_mac | search NOT os=unknown | chart count by os
The autoreg_registrations macro expands to this:
autoreg_registrations
index=ns-os sourcetype=autoreg source="/var/log/autoreg/applog" eventtype="network-registration-success"