Splunk table and regex filter

[mnjmht18]

I have following data in "log" field,
date1 name : message one
date2 name : message two
date3 name : message one
date4 name : message one
date5 name : message three
date6 name : message three

i want to filter this and create a table as below,
columns
log - count
message one - 3
message two - 1
message three - 2

how can i achieve this?

[vnravikumar]

Hi @mnjmht18

Try any one of the following

| makeresults 
| eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" 
| makemv delim="," log 
| mvexpand log 
| rex field=log "name :\s+(?P<log>[^:]+)$" 
| stats count by log

or

| makeresults 
| eval log="date1 name : message one,date2 name : message two,date3 name : message one,date4 name : message one,date5 name : message three,date6 name : message three" 
| makemv delim="," log 
| mvexpand log 
| eval log= mvindex(split(log,"name :"),-1) 
| stats count by log

[richgalloway]

Try this query.

... | rex field=log "name : (?<log>.*)"
| stats count by log