Regex to split field, optional second field

[pgreer_splunk]

I have a field that has a pattern where there is a first portion of the string that I'd like to capture into one field, then an optional second field that follows a ':'

For example:

field1
field1:field2
field1
...

I've tried

(?<myfield1>.*):(?<myfield2>.*)

but that only matches if the original field has the "field1:field2".
How should I set up the regex so that it always captures the 'field1' into 'myfield1' and will also capture 'field2' into 'myfield2' if it exists after a ':'?

[gokadroid · Accepted solution]

Try this regex and see if it works out for your case:

...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"

See Extraction Here

[pgreer_splunk]

That seems to have done it.

So if reading it correctly, the regex says "store into "myField1" one or more characters (in the string) that are NOT whitespace and NOT ':'. Which gobbles up anything until the next match between the groupings, which is zero or more of ':', then store into "myField2" zero or more non-whitespace characters".

That seems to have done it for me. Thanks!