How to organize search substrings into LookUp tables?

[pm771]

Hello

I have a Splunk query that looks like following:

index=something "*abc*" OR "*def*" OR "*hig*" 

These substrings do not belong to particular fields. Is there a way to put them in a lookup table?

If they were field values, I would've done something like: 

index=something
   [| inputlookup My.csv |  fields FieldName | format]

[richgalloway · Accepted solution]

If you put the strings in a lookup file using the field name foo then you should be able search for them using this query.

index=something
   [| inputlookup My.csv | return 1000 $foo]

[yuanliu]

Thank you, @richgalloway!  I never learned about return command and the use of $field.