Is there a way to search events from multiple source types when the list of source types is available in a lookup file?
To complete a bit @elpred0 answer, if you are not used to play with sub search, this is a more complete example of what your search should look like.
index=yourIndex [|inputlookup sourcetype.csv | fields sourcetype]
| your search
That should return all the events in yourIndex with the specified sourcetype in sourcetype.csv
View solution in original post
Hi @tusharsaran1 ,
Try this ...
in the search part of the query add this subsearch
[ |inputlookup lookup
If the field of the lookup is sourcetype and the values are correctly you will have something like this
( ( sourcetype="a" ) OR ( sourcetype="b" ) OR... etc
Here de docs of format http://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Format