SELECT count(value)
FROM alert_tnslsnr
WHERE event = 'establish' AND returncode = '0' AND comp_level_2 =~ /$listener/ AND service  =~ /$service/ AND cluster_name =~ /^$cluster$/ AND $timeFilter
GROUP BY cluster_name, clienthost, time($__interval) fill(null)