I am trying to search through a data set with a large amount of search terms. This works perfectly using inputlookup tables. The tables allow me to store lots of different terms in a list rather than putting them all in the query. As an example:
I know this is an old post but I too needed this exact same functionality. Being that none existed I created the matched command app--https://splunkbase.splunk.com/app/3209/. The app supplies just one command - matched - and can be used like so:
* [|inputlookup ransomware_variants|rename variant as search|format]|table _time _raw|matched csv="/opt/splunk/etc/system/lookups/ransomware_variants.csv"
Hopefully it helps someone else out with the same problem.