What rex command can separate hostname from the field?

[priya1926]

NONPROD:abcd123456_DBSERVER

Need to extract abcd123456 from the string...

[ITWhisperer]

Without the full context of the string or knowing which parts are fixed, I have guessed you want anything between the colon and the underscore:

| rex ":(?<hostname>[^_]+)_"