count SF block groups for splunk hack