Add your hashes into a csv and create a lookup from it.  Then your query would be something like:  index=(your index) .... [|inputlookup md5s.csv ...] ... with the "..." being your refining criteria for your search.     ... View more