I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.
In case you're calling it a field but it is actually a sourcetype , you'll have to check the inputs.conf files you have deployed.
If it is indeed a field, the answer from cramasta below is acceptable.
I dont think that is a Splunk default field. On the search head go to the manager and then to fields > field extractions and then search for src_hostname (make sure you set the app context pulldown menu and the user pulldown to All). that should list the regex that is being used to generate that field.
Stupid mistake on my behalf... it was a really long search, at the end of a really long day, and missed the lookup.
HAHAHAHAHHAHAHAH