Trying to regex the ci name out of an event value from another system

[RBfleming]

We are receiving testing.system\mssql as our node from a back up event management process.  I need to parse the ci out of this so we can relate the node.   I need everything before the \.

I have read through several messages and didn't find anything that would work but close 

Attempted (\w+) and it got the first name

Attempted (\w+)[^\\]+ in regex101 and it worked but no luck in event rule.

Any help appreciated. New to regex scripting.

[Jeff K1]

Assuming that is the entire value in the field, try: ^(.*)\\ or (.*)\\
That should grab everything up to the \