Depending on how you isolate those 4 firewall web traffic logs will drive how you edit this. If you want, you could use IPs, or sourcetype, host or source depending on how your system is built. Because you are not using a data model in this correlation search, you will need to keep in mind that something like src might not actually be called src, it might be s_ip or source_ip or some other key value. Some examination of that will be needed.
In the example below, I added 2 sourcetypes to the correlation search that allowed us to narrow the data that was looked at before the rest of the commands were run. This could be IP or hostname instead of sourcetype.
(sourcetype=bluecoat* OR sourcetype=ccnumbers) NOT sourcetype=stash | `get_integer_seq` | lookup luhn_lite_lookup integer_seq OUTPUTNEW pii,pii_clean | eval pii_length=len(pii_clean) | lookup iin_lookup iin as pii_clean,length as pii_length OUTPUTNEW iin_issuer | search iin_issuer=* | `get_event_id` | rename event_id as orig_event_id | eval orig_raw=_raw | fields - _raw | fields + orig_event_id,orig_raw,host,pii,iin_issuer | eval pii_hash=sha1(pii) | eval orig_time=_time
If I want to run this in a search window to evaluate my search ahead of deploying, I can also add sourcetype, ip address field names or whatever else viewable by adding those fields into the |fields + section of the search so those values can show when the log is expanded.
