I have a field that has a pattern where there is a first portion of the string that I'd like to capture into one field, then an optional second field that follows a ':'
For example:
field1
field1:field2
field1
...
I've tried
(?<myfield1>.*):(?<myfield2>.*)
but that only matches if the original field has the "field1:field2".
How should I set up the regex so that it always captures the 'field1' into 'myfield1' and will also capture 'field2' into 'myfield2' if it exists after a ':'?
Try this regex and see if it works out for your case:
...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"
Try this regex and see if it works out for your case:
...| rex "(?<myField1>[^\s:]+):*(?<myField2>\S*)"
That seems to have done it.
So if reading it correctly, the regex says "store into "myField1" one or more characters (in the string) that are NOT whitespace and NOT ':'. Which gobbles up anything until the next match between the groupings, which is zero or more of ':', then store into "myField2" zero or more non-whitespace characters".
That seems to have done it for me. Thanks!