I'm trying to build a dashboard search that will allow someone to put in an ID and it will do a lookup on the FailureReason code that is part of the Cisco ISE authentication logs that will take into account different platforms like F5, Cisco 9K, Infoblox, etc... The FailureReason code appears in all CSCOacs_failed_attempt logs but it's located in slightly different parts of the ISE log depending on the platform that the user is trying to login to.
I have three different regex expressions, one that works on F5, one for Cisco 9K, and one for Infoblox. Is there a way that I can have the search look through the logs using the three different regex expressions and give me back the result for the one that gives a hit?
