Regex to pull specific field from Microsoft SQL log?

I’m currently following the documentation at nxlog.co/documentation/nxlog-user-guide/mssql.html#mssql_audit_collect to pull specific fields out of the $Message field from MSSQL logs, but I can’t seem to pull the server_principal_name as it’s own key/value pair properly.

The MSSQL logs come in the format “Message:…\nsession_server_principal_name:\nserver_principal_name:Domain\\USERNAME\nserver_principal_sid:XX\ndatabase_principal_name:XX”

I’m using the following regex to pull the server_principal_name:
if $Message =~ /server_principal_name:(.*)/ $SPN = $1;

I can definitely see there is a server_principal_name in the MSSQL log, but SPN always comes up an empty value when using the above regex.

Does anyone have any ideas why the SPN comes up empty? Is there something wrong with the above regex?