|tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication where Authentication.action="failure" by _time Authentication.dest span=1s
| rename Authentication.* AS *
| streamstats time_window=1m sum(count) AS dest_failures by dest