I'm analyzing the SMF, but as you all know, the format is multiline.
Not really. . . What you are trying to do is use some data that is no longer in SMF format
. Even if you had something that would do what you want with the raw SMF data, it would not work for the "file" that was posted.
And maybe the users that just READ and for some reason they have permission to ALTER.
There are people who only do an update every year or 2. . . They read all of the time, but only update for some extroardinary process. Suggest someone review everyone who has "alter" permission - there should be very few for production datasets.
Sounds like you would be better served using other than SMF for what you want.