Search events for multiple samaccountnames

[papa]

Hello 

Cam someone assist on how to do a search like below for multiple samaccountnames ? 

ideally from a txt file or CSV ? so to reference the file in the search . 

<SamAccountName> EventCode=4624 | table _time,EventCode,src,user,Logon_Type

[inventsekar]

Hi @papa , As @renjith_nair suggested, the lookup is one idea. or if you already ingested the 
multiple samaccountnames csv files to splunk, then, you can simply query the multiple files altogether.  my apologies if you already know this method. 

index=indexName <multiple-SamAccountNames> EventCode=4624 | table _time,EventCode,src,user,Logon_Type

[renjith_nair]

Try

index="your index" EventCode=4624 [|inputlookup SamAccountName.csv|fields SamAccountName] 

This should create an OR'd list of SamAccountName