How to check value of my search present in which lookup table

[akshayinnamuri]

Hi

I am looking for query where say for example user=xyz which is present in multiple watchlists [watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv] and not present in watchlist_E.csv, watchlist_F.csv

watchlist have columns
[ number, user, date ]

     1, xyz, 01022000

      2, abc, 02022000

I am looking for query to use multiple watchlist and find value of my search say user=abc when queried should show a table as below 

user, watchlistNames

If result is present in multiple table it should give me the watclistnames

where my search is user=abc and is present in watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv

so my query result should be

user, Watchlistnames

abc,watchlist_A.csv, watchlist_B.csv, watchlist_C.csv, watchlist_D.csv

[gcusello]

Hi @akshayinnamuri,

please try something like this:

<your_search>
| lookup watchlist_A.csv user OUTPUT number AS number_watchlist_A.csv
| lookup watchlist_B.csv user OUTPUT number AS number_watchlist_B.csv
| lookup watchlist_C.csv user OUTPUT number AS number_watchlist_C.csv
| lookup watchlist_D.csv user OUTPUT number AS number_watchlist_D.csv
| table user number_watchlist_A.csv number_watchlist_B.csv number_watchlist_C.csv number_watchlist_D.csv

Then, if you likem you can also put a status message (using eval) to indicate if some lookup is missing.

Ciao.

giuseppe