Here is an example of a VPN log with an error. I want to create a field for "Reason", which includes everything found after "Reason:", until the end of the line:
2014-02-26 11:26:05 -05:00 @vpn1 id=firewall time="2014-02-26 11:26:05" pri=6 fw=X.X.X.X vpn=vpn1 user=XXX realm="XXXX" roles="XXXXX" proto=auth src=X.X.X.X dst= dstname= type=vpn op= arg="" result= sent= rcvd= agent="" duration= msg="AUT22925: Host Checker policy 'Comp Configuration Check' failed on host X.X.X.X for user 'XXX'. Reason: 'Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\XXX\not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\Wow6432Node\XXX\Plan not found; Registry key: HKEY_LOCAL_MACHINE\XXX\Plan not found'."
Thanks!
