b.k.

splunk

Assign an extra field value

eval hostType="old"

Replace part of a string

eval src=replace(CLIENT, ":.*", "")

Compare fields

where src != dest