Splunk

Training

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

Search

Match Value (.*) after "want:" and turn it into a field (field_name)

 | rex field=_raw "some text before what we want:(?<field_name>.*)"  

Group results into 1 hour chunks

 | timechart span=1h count(field_name) by field_name 

Export RAW logs

host=<host_name> | table _raw | outputcsv rawdump.csv

Then download as csv