How to use lookup table in where in condition?

[splunkuser320]

I need to create a query where I need to populate a column's values from a lookup table as a default value.  Basically, replace all All in the below value with the values of the column. 

index = "XXX"  log_group IN("All")
| stats sum(event)

Thanks 

[richgalloway]

This is more of a search question than a dashboard question.

You can use inputlookup in a subsearch to get a list of all column values from a lookup table.

index = "XXX"  [ | inputlookup mylookup.csv | fields log_group | format ]
| stats sum(event)