You can use Field Extractor and then choose Regex and highlight the hostname part after selecting a sample event from your search.
Also same can be achieved by delimiter method and then you can remove unwanted extractions and can only keep hostname extraction i.e. after 4th semicolon as you have mentioned.
Regex will suit you best here.
For more information refer this link http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/FXSelectSamplestep