How do I create an alert that is triggered if group name exists in a lookup table?

[AL3Z]

Hi,
I want to create an alert that triggers when a user_name  exist in a lookup table (e.g. group_names.csv). But I'm not sure how to create the search string for this. The fields I'm using in the group_names.csv lookup table is group_names type as follows:

If the user_name matches group_names listed in the table, the alert should triggered. Any help on how to do this are much appreciated.

Thanks..

[yuanliu]

To match user_name with group_names listed in a lookup, you can use a subsearch if there is no other condition that you need to calculate.

<some additional filters>
  [ | inputlookup group_names.csv
  | rename group_names as user_name ]
| stats count by user_name

Hope this helps.