Help with Rex or RegEx - Need Everything After a String

[aferone]

Here is an example of a VPN log with an error. I want to create a field for "Reason", which includes everything found after "Reason:", until the end of the line:

2014-02-26 11:26:05 -05:00 @vpn1 id=firewall time="2014-02-26 11:26:05" pri=6 fw=X.X.X.X vpn=vpn1 user=XXX realm="XXXX" roles="XXXXX" proto=auth src=X.X.X.X dst= dstname= type=vpn op= arg="" result= sent= rcvd= agent="" duration= msg="AUT22925: Host Checker policy 'Comp Configuration Check' failed on host X.X.X.X  for user 'XXX'. Reason: 'Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\XXX\not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan  not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found'."

Thanks!

[somesoni2 · Accepted solution]

Try this

your base search | rex "Reason:(?<Reason>.*)"

[aferone]

Nailed it! Thank you!