Using regex to extract word after semicolons

[TCK101]

Hi

I am attempt to extra host names from logs they always appear after the 4th semicolon :

E.g. I want the extra the "hostname" as a field and ignore all the characters and spaces before the 4th semicolon (:)

May 19 10:09:41 server1 Device: Script Completed Successfully: hostname1
May 19 11:13:01 server2 Device: Script Completed Successfully: hostname2
May 19 17:09:21 server3 Device: Script Completed Successfully: hostname3

[niketn]

This could be one of the easiest regular expression, however there are multiple options.

your base search 
| rex field=_raw "Script Completed Successfully: (?<hostname>.*)"
| table hostname _raw

Once you have tested the Regular Expression you should move the same to Field Extractions using props.conf.

[bishtk · Accepted solution]

You can use Field Extractor and then choose Regex and highlight the hostname part after selecting a sample event from your search.
Also same can be achieved by delimiter method and then you can remove unwanted extractions and can only keep hostname extraction i.e. after 4th semicolon as you have mentioned.
Regex will suit you best here.
For more information refer this link
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/FXSelectSamplestep