fork-with-if

destination dd {
   file("whatever");
};

log {
  source(pan_splunk);
  if { 
    filter { host("^[a-z]+\.foo.*$")    or
      netmask('192.168.1.100/32')   or
      netmask('192.168.1.101/32');
    };
    rewrite {
      set("foo" value("location"));
    };
  } elif { 
    filter { host("^[a-z]+\.bar.*$")    or
      netmask('192.168.1.102/32')   or
      netmask('192.168.1.103/32'); 
   };
  } else {
    rewrite {
      set("unknown" value("location"));
   };
   
   destination(dd);
};

fork-with-logpath

log {
  source(pan_splunk);
  
  log {
      filter { host("^[a-z]+\.foo.*$") or
               netmask('192.168.1.100/32')   or
               netmask('192.168.1.101/32');
      };
      rewrite { set("foo" value("location")); };
      destination(dd);
      flags(final);
  };
  
  log {
    filter { host("^[a-z]+\.bar.*$")    or
             netmask('192.168.1.102/32')   or
             netmask('192.168.1.103/32'); 
    };
    destination(dd);
    flags(final);
  };
    
  log {
    rewrite { set("unknown" value("location")); };
    destination(dd);
    flags(final);
  };
};