Filtering on lookup field values using multiple values on a few field

[landen99]

Searching for events which match any of multiple values for the same field times several fields in a lookup using the subsearch filter or the mv_append eval function.

[landen99 · Accepted solution]

The most efficient approach is a subsearch filter using the case-insensitive search command before the first pipe (preferred) if the list of values is under 50k:

index=myindex OR index=myindex2 [| inputlookup mycsv | search (cpu=1 hostname=stuff) OR (cpu=2 hostname=stuff2) | table hostname | rename hostname AS host ]

Creating a multi-value field to match on the lookup table, the mvappend command does the job:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

... | eval field_mvappend=mvappend(field_mv, "middle value", field_sv) | lookup mycsv field_mvappend OUTPUT mynewfield | search mynewfield=*

Or if the issue is only with case, you can either format the case in the lookup and in the source data using lower(). I prefer all field values to be lowercase.