extract module name (till colon)

[indeed_2000]

Hi

regex for extract module name 

here is the log:

15:25:36.999 user module_W: A[00]B[0000000]C[0]L: process read compeleted!

the module name is "module_W" after user "start  with star wildcard till colon"

Any idea?

Thanks,

[ITWhisperer]

| rex "user (?<module>[^:]+)"

[indeed_2000]

thank you for answer, user is not static value are different for users, is it possible to set (variable user after that space) for first part? 

FYI: there are some special character in users

[ITWhisperer · Accepted solution]

| rex "^\S+\s\S+\s(?<module>[^:]+)"