The query your tried is just grouping by _time to no Web.dest field is available to filter. Try like this | tstats count(Web.dest) AS destCount FROM datamodel=Web WHERE Web.action=blocked GROUPBY Web.dest _time span=1m | regex Web.dest="\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$" ... View more

There was no answer to this and I am having a similar problem. In the /opt/splunk/etc/apps/TA-eStreamer/bin/encore there are two conf files. The first is default.conf and the second is estreamer.conf. In the file estreamer.conf, I made sure that the server information under subcription which is at the bottom of the file. I entered a valid IP for the line "host": "1.2.3.4" and a valid pkcsFilepath to where the client.pkcs12 certificate it is. I still had problems with the estreamer being stopped. The default one has the same information and I can't get the estreamer to start. So I input the same information into the default.conf and estreamer still isn't working. I hope someone has an answer to this problem. ... View more