How to get results only if search field contains a word in the lookup table

[ashishmgupta]

If I have a search result which has a field named "Field1" and It has values like :
This is Word1 now.
This is Word2 now.
This is WordX now.
This is WordZ now.

Below is the look up table for Words.

Field1
Word1
Word2
Word3
Word4
Word5
Word6

How can I search so I get ONLY below results in the output because they contain "Word1" and "Word2"?
This is Word1 now.
This is Word2 now.

[maciep]

I'd say grab the word, look it up and then filter....maybe something like this (not at all tested)

index=whatevs
| rex field=Field1 "^(?:\S+\s+){2}(?<my_word>\S+)"
| lookup word_lookup_table Field1 AS my_word OUTPUT Field1 AS found_word
| where isnotnull(found_word)

And if you didn't want to rex out the word, you could also configure your lookup to wildcard the Field1 field.
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Addfieldmatchingrulestoyourlookupconfig...