@marktechuk - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.
If following is your data you can use split and mvindex commands in conjunction to split based on backslash and then read first value:
Your Base Search Here | eval SplitFields=split(fieldName,"/") | eval firstField=mvindex(SplitFields,1)| table fieldName, SplitFields, firstField
As split command splits fieldName to multivalue field SplitFields, you need to call mvindex command to fetch the first value.
rex doesn't make assignments. The 'field' keyword is literally "field"; replace 'myField' with the name of the field you want to extract from. So your query becomes
sourcetype=proxy github.com cs_uri_path!=/ cs_uri_path="*" |rex field=cs_uri_path "*" "\/(?<newField>[^\/]+)" |