How to create a search where a field value can equal any value from a specific column of a lookup table

[ccschulstad]

I am trying to create a search that returns events where a field's value equals any value from a specific column of a lookup table...

Lookup Table:

Account, Email,     User
abc,     abc@z.com, a
def,     def@z.com, d
ghi,     ghi@z.com, g

Desired Search:

Index=myIndex act="abc" OR act="def" OR act="ghi"

My lookup table has hundreds of rows. How do I perform this simple search where the field "act" can equal any value from the "Account" column in my lookup table? Thanks in advance for the help!

[yannK]

rename the lookup field "Account" to the search field name "act", then use the lookup in a subsearch, (it will convert to condition like A=1 OR A=2 OS A=3 etc...)

     Index=myIndex [ | inputlookup mylookup.csv | eval act=Account | table act ] 

see https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Useasubsearch