Search Input based on a inputlookup

[aquinojason]

Hi, 

I am trying to do the following:

1. Using this | inputlookup Application.csv where BusinessUnit = BU1, it will filter a list of Account Codes e.g. AC1, AC2, AC3

2. I want to use that list of Account Codes to filter my search on a different sourcetype.

index=index1 sourcetype=sourctypeN ACCOUNT_CODE = "AC1" or ACCOUNT_CODE "AC2" and so on..

Thanks!

[richgalloway · Accepted solution]

Put the two searches together like this:

index=index1 sourcetype=sourctypeN [ | inputlookup Application.csv where BusinessUnit = BU1 | return 1000 ACCOUNT_CODE ]

[aquinojason]

Spoiler

Thank you. it worked.