How to replace only second instance of header?

Try the getfield command:

 

getfield

 

I am not sure of the separator of the host header string (replace ":" with the appropriate separator) and use 2 for the field_number

 

 

when HTTP_REQUEST {

 

[getfield [HTTP::header] ":" 2]

 

}