This doesn't really seem to be a question, but let me try to answer it anyway.
yoursearchhere
| rex "eventValue:(?<eventValue>.*)\]"
| timechart count by eventValue
This assumes that you do not already have a field named eventValue . If you do have the field, you can leave off the second line.
... View more
