Extracting Text/Field from _raw Microsoft Event For Failed Backups

[SplunkLunk]

Greetings,

I want to run a report/alert when a MSSQL backup job has failed. It looks like the info I want is only displayed in the _raw field. Can anyone tell me how I can use the rex command to get the name of the database that has failed? The _raw event data looks like this:

2017-11-27 12:34:33.71 Backup BACKUP failed to complete the command BACKUP DATABASE WideWorldImportersDW. Check the backup application log for detailed messages.

The name of the database in this case is "WideWorldImportersDW". However, other database names will always be sandwiched between "BACKUP DATABASE" and ". Check" Can someone help me craft the rex expression to give me the text between "BACKUP DATABASE" and ". Check"? Thanks for any assistance.

[woodcock · Accepted solution]

Do this:

Your Search Here
| rex "BACKUP DATABASE (?<DBName>\S+). Check"
| search NOT DBName="*"

Refine your rex until none of your events are making it past the last search filter line.

[SplunkLunk]

So, this is what I've tried and it seems to work:

|rex field=_raw "BACKUP DATABASE (?[^\s]+). Check"

Is there a better way? I'm not sure if this will miss any events. Maybe there is a better way.