How to use/do where in column of a lookup in Splunk Search Query

Question

I want the search with a field which match with any of the values in look up table.

For now, I have used below where in query. But, I still want to query with Look up table instead of manually putting all those values in double quotes using the in clause.

|where in(search,"abcd","bcda","efsg","zyca");

Answer 1

First, you need to create a lookup field in the Splunk Lookup manager. Here you can specify a CSV file or KMZ file as the lookup. You will name the lookup definition here too. Be sure to share this lookup definition with the applications that will use it.

Once you have a lookup definition created, you can use it in a query with the Lookup Command. Say you named your lookup definition "my_lookup_csv", and your lookup column in your search is "event_column", and your csv column names are "column1", "column2", etc. Your search query will now end in:

| lookup my_lookup_csv column1 as event_column