get substring from long raw string

[tsek13]

Hi guys, i am newbie in Splunk and i have the following indexed line:

Mar 21 20:12:14 HOST program name: 2013-03-21 20:12:14,424 | INFO  | Event 'x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw|' is not allowed. | sdfsdfsdfsd | sdfsdfwerwe thread #8 - Jfsdfsdfssd]

How can I do this:
- get only x.y|z.k|asdfvgh|sdfklsd|sdfsdtrwe|asafhwej|qoqwpeirw
- put the string x.y|.z.k... in new field (a =x.y|...)
- Remove duplicate values
- count all distinct strings
- generate chart or timechart or an hitmap with number of distinct strings

Thanhs for all your suport

[tsek13]

Many thanks Iguinn!
Yes, I need to restrict only to events that contain a messageString but for now your hint works fine!

[lguinn2 · Accepted solution]

Try this:

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| stats count by messageString

or

yoursearchhere
| rex "Event \'(?<messageString>.*?)\' is not allowed."
| timechart distinct_count(messageString)

Replace "yoursearchhere" with whatever makes sense; that might mean something like sourcetype=xyz
Did you need to restrict the search only to events that actually contain a messageString?