Currently I'm dealing with a logfile which outputs different data depending on the action which has occurred, one parse statement cannot handle all the options so I have multiple parse statements.
I need to combine it all into one table at the end, but the only option I've found so far is via multiple fetch & appends, which feels very inefficient and clunky. Is there are way to streamline this sort of query?
As an example:
fetch logs, from: -3d
| filter dt.host_group.id == "myTag"
| filter matchesPhrase(content, "myFirstTextToMatch")
| parse content, "DATA blah blah blah parse out fields here"
| append [fetch logs, from: -3d
| filter dt.host_group.id == "myTag"
| filter matchesPhrase(content, "mySecondTextToMatch")
| parse content, "DATA blah blah blah parse out second pattern fields here"
| append [fetch logs, from: -3d
| filter dt.host_group.id == "myTag"
| filter matchesPhrase(content, "myThirdTextToMatch")
| parse content, "DATA blah blah blah parse out third pattern fields here"
... and so on
Is there a way to use a conditional operator here maybe?
ie, IF matches FirstText then parse using First pattern ELSE IF matches SecondText parse using Second pattern...
