How to edit my regex to remove all text before ":" if there is more than one

[nikolaevnz]

Hello Team, Splunkers, 

I am working on a correlation search and need to use a regex expression to strip all text before a column ":". Following the suggestion presented in: 

https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-regex-to-remove-all-text-before-an-opti...

I managed to strip the text using this expression which was derived from the topic above: 

| rex field=my_host "(?<my_host>[^\:]+)$"

and apply it to the following line: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D 

it will work and I will receive: my_host.server;D

However if I apply the above expression to the same line but with column at the end of the string looking like this: 

Microsoft.Windows.Server.10.0.LogicalDisk:my_host.server;D:

this will not be matched. Could you please assist me with editing my expression to cover both cases and still get my_host.server;D as a result.

Regards Nikolay

[nikolaevnz]

Thank you for the help it woks as intended. 

[richgalloway · Accepted solution]

Try this command.  There may be other expressions that accomplish the same thing, but this one matches the examples provided.

| rex field=my_host ":(?<my_host>[^\:]+):?$"