messages text regex

I'm using kiwi syslog ver 9.3.  I'm getting the following syslog message that I'd like to modify before it displays on my screen. 

Nov 19 16:17:38 opchmon0001 %OrionAlertEngine: .blu-c01-trd-csw02 is Down

All I care about is things after the colon, so essentially just blu-c01-trd-csw02 is Down

I created a regex filter to include ": .*" but this still doesn't work, but it seems like ti should.  Does anyone have an suggestion to get this to work?

Thanks for looking,

Pete