Thank you for the response; this is actually still an issue I never resolved. I attempted your solution with no luck. When I wrote the question I mistyped the bolded text and added a space. The following is a more accurate example of the search normalized with correct spacing and line breaks added for readability. As you can see in the index5 line, the text was not regex out. I do successfully regex out several other strings before being normalized.
| eval logSource=case
( index="index1" AND ( sourcetype=xxxxx OR sourcetype=xxxxxx OR sourcetype=xxxxxxx ) , "Logs 1" ,
index="index2" AND ( sourcetype=xxxxx ) , "Logs 2" ,
index="index3" AND ( sourcetype=xxxxx ) , "Logs 3" ,
index="index4" AND ( sourcetype=xxxxx ) , "Logs 4" ,
index="index5" AND ( sourcetype="" ) , "Logs 5" ,
1=1, "Unknown" )
... View more