You are over-complicating it; try using a MyRulesLookup.csv Lookup table like this: condition, Justification ((processPath=="C:\windows\system32\lsass.exe") AND (UDP_Listener_Add_Remove="True")), Some justification string ((processPath=="C:\windows\system32\lsass.exe") AND (LocalPort>49152)), Some other justification string Then your search should be like this: index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo AND [|inputlookup MyRulesLookup.csv | table condition | stats values(condition) AS search | eval search = mvjoin(search, " OR ") | return $search ] ... View more