Is this possible with loki / grafana

Hi all,
I am fighting with google but not able to find any solution. So I would like ask experts here. I have configured loki / promtail / grafana to collect syslogs from Mikrotik devices. I want to show top IP address and targets from dns requests.
lines looks like this:

2020-08-29T20:20:11.299661+02:00 dns dns: query from #20923 apple. A
2020-08-29T20:20:07.399266+02:00 dns dns: query from #20922 google. A
2020-08-29T20:20:07.183353+02:00 dns dns: query from #20921 netflix. A
2020-08-29T20:20:04.988434+02:00 dns dns: query from #20920 apple. A
2020-08-29T20:20:04.659936+02:00 dns dns: query from #20919 microsoft. A

I would like to have output like this: = 3x = 2x

apple. = 2x
google. = 1x
netflix. = 1x
microsoft. = 1x

If it is possible please point me to some documents. Many thanks for any help.