How to use regex lookahead to capture the information from the 4th stanza of my log?

[mikecal]

I'm trying to use the following search to capture information regarding an identification code:

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex field=_raw "Filename(?<phoneid>)(?=[A-Z][A-Z][A-Z]).*(?=-)"
| stats count by phoneid

Here an example of the log entry:

2023-01-04 15:08:09.001175 DEBUG [0xce4] VoiceRecorderUpdateTask.cpp[28] VoiceRecorderUpdateTask::runTask: MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS : Filename(4281-1672873674000-4125-SEP12345678-98962688)

I want to capture the information from the 4th stanza.  I'm trying to use lookahead to target the three alpha characters.  This works as expected in regex101.com but Splunk is not producing any results.  I've read in several articles that lookahead doesn't work as you would expect it to but I haven't been able to piece together a search that will work.  Maybe I'm going about this the wrong way.  Any help is appreciated.

Thanks,

Mike

[mikecal]

Thanks @richgalloway and @gcusello for your quick replies!  Ultimately, Rich's search served my needs best.  One funny oddity, I needed to use the dash after the stanza as a delimiter and lookahead worked just fine in that capacity.  

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex field=_raw "Filename\([\d-]+(?<phoneid>[A-Z]{3}.*(?=-))"
| stats count by phoneid

[gcusello]

Hi @mikecal,

i you want to extract the full phoneid, you can use :

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex "Filename\((?<phoneid>[^\)]+)"
| stats count by phoneid

that you can test at https://regex101.com/r/o6MmDk/1

if you want only the last numbers, you can use

index=calabrio MSG_VOICERECORDING_NOTIFY:SRC_NOTIFY_NO_PACKETS
| rex "Filename\(\w+-\w+-\w+-\w+-(?<IBAN>[^\)]+)"
| stats count by phoneid

that you can test at https://regex101.com/r/o6MmDk/2 

Ciao.

Giuseppe

[richgalloway · Accepted solution]

As you've read, Splunk does not do well with lookahead (or lookbehind).  Fortunately, lookahead rarely is necessary.  Try this regex to get the three letters in the Filename field.

Filename\([\d-]+(?<phoneid>[A-Z]{3})