Problem - the dashboard was not displaying blackholed client summaries.
Solution -
I cloned a saved search for pi-hole and used the following search:
index=pi-hole sourcetype="pi-hole" "gravity.list" | rex field=_raw "/etc/pihole/gravity.list (?<blkHoledDomain>.*) is" | rex field=_raw "dnsmasq\[\d+\]:\s\d+\s(?<ClientIP>.*?)/"
I then edited the dashboard inline search to use the new cloned searches name for blackholed events.
