How to filter events by date fields in lookup table

[kvandegrift]

I have a lookup table that consists of the follow fields: Account_Name, Name, Start Date, Return Date. I want to search for windows event log activity for account names listed in the lookup table that are >= Start Date and < Return Date. I have been able to search for logon events using the Account_Name in the lookup as a filter, but how do I use the dates in the lookup file to filter for the event dates also? Search that works for filtering by lookup Account_Name is:

[inputlookup employee_vac | fields Account_Name] (index=winserver_events OR index=win-dc-security) sourcetype="WinEventLog:Security" 
eventtype="msad-nt6-successful-user-logons" 
EventCode="4624" Account_Name="*" 
| eval date=strftime(_time, "%Y-%m-%d") | eval Account_Name=lower(Account_Name) 
| table date, "Start Date", "Return Date", Account_Name, Workstation_Name, src_ip, Logon_Type

This search uses the lookup to only return windows logon events for accounts listed in the lookup file, but does not return any additional fields ("Start Date", "Return Date") from the lookup table.

[somesoni2]

This should do it

[inputlookup employee_vac | fields Account_Name] (index=winserver_events OR index=win-dc-security) sourcetype="WinEventLog:Security" 
eventtype="msad-nt6-successful-user-logons" 
EventCode="4624" Account_Name="*" 
| eval date=strftime(_time, "%Y-%m-%d") | lookup employee_vac AccountName | eval Account_Name=lower(Account_Name) 
| table date, "Start Date", "Return Date", Account_Name, Workstation_Name, src_ip, Logon_Type

[richgalloway]

If you remove | fields Account_Name from your query you should get all of the fields from your lookup file.