Lets say your Lookup table is "inputLookup.csv" and it is as follows:
Field1,Field2
AA,11
AB,22
AC,33
BA,21
BB,22
BC,23
You can match terms from input lookup on any of the above fields Field1 or Field2 as follows (I am matching on Field1 and displaying Field2):
|inputlookup inputLookup.csv | search Field1=A* | fields Field2
If you now want to use all the Field2 values which returned based on your match Field1=A* as subsearch then try:
yourBaseSearch [ |inputlookup inputLookup.csv | search Field1=A* | fields Field2 ]
Updating as per the comment conversation:
index=proxysg sourcetype=proxysg_base [|inputlookup aterms.csv | return 10000 $aterms]
| rename _raw as rawText
| eval foo=[|inputlookup aterms.csv |stats values(aterms) as query | eval query=mvjoin(query,",") | fields query | format "" "" "" "" "" ""]
| eval foo=split(foo,",")
| mvexpand foo
| eval foo=lower(foo)
| eval rawText=lower(rawText)
| where like(rawText,"%"+foo+"%")
| table rawText, foo
