How to use a column of data in a CSV lookup to initiate a search?

[joea9]

I am using a CSV lookup that adds additional fields to my Splunk search results...

Search string:

date_month=october OR date_month=june | lookup mylookup month as date_month

CSV file:

month,shortname
july,jul
june,jun
october,oct

So it's matching the date_month field in my search results with the month column in my CSV file and returning the 'shortname' as a new field.

QUESTION

However, I want to use data in my CSV file to initiate the search instead. I want to do a lookup that will return all of the months in the month column of my CSV file, and then do a search on them, while including the additional 'shortname' field in the search results?

I got this far:

| inputlookup myiplookup | fields month

Which returns the list of values in my CSV 'month' column, but it doesn't actually search on them, and doesn't return the 'shortname' field.

[martin_mueller]

Searching based on lookup fields and adding fields to results from a lookup are two separate things, so you will need to do two steps to achieve this.

First, configure your lookup as an automatic lookup on your data. That'll allow you to leave off the explicitly | lookup command from your first search.
Second, run a search like this:

index=foo sourcetype=bar [inputlookup mylookup | fields month | rename month as date_month] | ...

That'll build an OR'd list of date_month filters from your lookup.

As an alternative, having the automatic lookup also allows you to write this kind of search:

index=foo sourcetype=bar shortname=jun | ...

That will be translated to date_month=june under the hood.