how to eliminate the required values in field

[james_n]

Hi Experts,

Please help with regex to  parse the hh:mm:ss into separate filed as show below.

message:

hello this is the first message from splunk 12:45:13
hai this is the second message from splunk 
hello this is the third message from splunk 19:43:53

expected outpout:

subject:                                                                                                        time:
hello this is the first message from splunk                              12:45:13
hai this is the second message from splunk 
hello this is the third message from splunk                              19:43:53

| rex field=message "(?<subject>.\w+)\s*(?<time>.\d+:\d+:\d+)?" but not worked. plz help thanks in advance.

[bowesmana]

@james_n 

This will work for your example, but not sure if it will work for all your data

| rex field=message "(?<subject>.*) (?<time>\d+:\d+:\d+)?"

[to4kawa]

please rex separately.