If your field is called 'field' then this
| rex field=field "(?<field1>[^_]*)_(?<field2>.*)"
will create new fields 'field1' and 'field2'
If your field is called 'field' then this
| rex field=field "(?<field1>[^_]*)_(?<field2>.*)"
will create new fields 'field1' and 'field2'