So I may have been asking the wrong question, but I found a solution that works for me I needed WILDCARD(keyword) under the lookup definition Advanced settings and fileName data needed "" *on both sides.
Where "keyword" is the column name containing fileName data
index=USB_activity_data [|inputlookup interesting-filenames.csv| fields keyword| rename keyword as FileName] |rename FileName as keyword |lookup interesting-filenames.csv keyword OUTPUT keyword as matchedValue uuid
I can then pipe this query into a table to pull all the fields I need.
... View more