I have looked through the forums and can't find exactly what I am looking for.
Here is my search and what I think should work, but I don't think I completely understand multisearch.
| multisearch
[ search index=patch sourcetype=device host="bradley-lab" device_group=PRE*
| where match(host,"bradley-lab")]
[ search index=patch sourcetype=device host="bradley-lab" device_group=BFV*
| where NOT match(host,"bradley-lab")]
| dedup extracted_host
| eval my_time=_time
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_time)
| rename extracted_host as device_Name, my_time as "Date Posted"
| table "Date Posted" device_group device_Name current_system_version latest_system_version status
host=bradley-lab will come from a token drilldown on a dashboard
if the host is bradley-lab I want it to show all devices with the device_group=PRE
and if the host is anything else, I want it to show all devices with device_group=BFV
Try something like this
index=patch sourcetype=device device_group=PRE* OR device_group=BFV*
| where (match(host,"bradley-lab") AND searchmatch(device_group=PRE*)) OR (NOT match(host,"bradley-lab") AND searchmatch(device_group=BFV*))
| dedup extracted_host
| eval my_time=_time
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(my_time)
| rename extracted_host as device_Name, my_time as "Date Posted"
| table "Date Posted" device_group device_Name current_system_version latest_system_version status