I'm fairly new to Splunk and I looked at the possible "Questions that may already have your answer?" and didn't find something clear or looked like what I needed.
This is my string that I'm trying to get out of a log from an application:
15-Sep-2015 09:29:22 MyApplication Successful Delivery to Destination XXXXXXX Batch No 459 (DR ID: 194)
The goal is to get a count of these messages for each value in XXXXXXX - so I would then
have something like (of course in a nice graph 🙂
XXXXXX1 : 304
XXXXXX2 : 984
XXXXXX3 : 543
Try this
your base search | rex "Delivery to Destination (?<Destination>[^\s]+)" | stats count by Destination