How to create the Conditional search?

[tcpcannon]

I have looked through the forums and can't find exactly what I am looking for.

Here is my search and what I think should work, but I don't think I completely understand multisearch.

| multisearch
[ search index=patch sourcetype=device host="bradley-lab" device_group=PRE*
| where match(host,"bradley-lab")]
[ search index=patch sourcetype=device host="bradley-lab" device_group=BFV*
| where NOT match(host,"bradley-lab")]

| dedup extracted_host
| eval my_time=_time
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_time)
| rename extracted_host as device_Name, my_time as "Date Posted"
| table "Date Posted" device_group device_Name current_system_version latest_system_version status

host=bradley-lab will come from a token drilldown on a dashboard

if the host is bradley-lab I want it to show all devices with the device_group=PRE
and if the host is anything else, I want it to show all devices with device_group=BFV

[ITWhisperer]

Try something like this

index=patch sourcetype=device device_group=PRE* OR device_group=BFV*
| where (match(host,"bradley-lab") AND searchmatch(device_group=PRE*)) OR (NOT match(host,"bradley-lab") AND searchmatch(device_group=BFV*))

| dedup extracted_host
| eval my_time=_time
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_time)
| rename extracted_host as device_Name, my_time as "Date Posted"
| table "Date Posted" device_group device_Name current_system_version latest_system_version status