Hi,
I want to create an alert that triggers when a user_name exist in a lookup table (e.g. group_names.csv). But I'm not sure how to create the search string for this. The fields I'm using in the group_names.csv lookup table is group_names type as follows:
If the user_name matches group_names listed in the table, the alert should triggered. Any help on how to do this are much appreciated.
Thanks..
To match user_name with group_names listed in a lookup, you can use a subsearch if there is no other condition that you need to calculate.
<some additional filters>
[ | inputlookup group_names.csv
| rename group_names as user_name ]
| stats count by user_name
Hope this helps.