Ok, so you have two fields named "source" ?
You are trying to search this data? NOT modify it at index time?
If you are tying to search against the data, you will need to Eval or Rex it. Ultimately, you need get a little fancy to capture the values there. Ultimately, correcting this at index time is the best solution.
If it were me, I would extract everything with the rex below, then search for all sources that do not have \ (since most sources have the \ to the directory of the log).
| rex field=source "(?<newSourceName>[\w\W]*)"
| search newSourceName!="*\*"
... View more