OK, so I tried the first suggestion and that did not seem to work. Probably b/c of the rex vs regex issue.
I am sorry for messing up the initial post, it is my very first post. Typically the standard searches work fine for me, but this one needs something a bit more than typical. I am very much not an expert at searching with Splunk. So I apologize if I am asking the wrong questions here.
I will look into the regex a bit more. I had tried it previously as well, but the search of Deleting user context for [a-z] did not return properly even though a regex testing website validated and brought back the correct results. I figured at that point I was just not doing something right when it came to Splunk and its use of regular expressions which is why I turned here for help.
... View more