My requirement is something like this: Lookup 1 looks like this Name | Avg_Count A          | 3 B          |  7 D          | 8 F           | 5 Lookup 2 looks like this: Name | Current_Count A          | 2 C          | 4 D          | 6 In the search, I input both these lookups and want results like this: Name | Avg_Count | Current_count A          | 3                     | 2 B          | 7                     | 0/null (0 preferred) D          | 8                     | 6 F          | 5                      | 0 C         | 0                      | 4 I have tried join/append/appendcols but all these have their limitations and won't give the intended results. Also looked at many solutions from community but couldn't find one. Thanks in advance! Shaquib ... View more

Hi All, I am stuck with 'Waiting for Input' error for one of the panels that I created in Splunk Dashboard. However, the search runs fine in Search app. Reading through other similar questions, it seems related to tokens. Tried rectifying it but no good. Following are the search and XML: Search: | inputlookup xxxxxxx.csv | stats dc(title) as number_of_rule, values(title) as rules by category | map [| inputlookup yyyyyyyy.csv | eval Date=strftime(_time, \"%m/%d/%Y\") | eval month=strftime(_time, \"%m\") | eval current_month=strftime(now(),\"%m\") | where month=current_month-1 | search index=$$category$$ | stats sum(GB) as GB by index | eval GB=round(GB,3) | eval index=\"$$category$$\", number_of_rule=\"$$number_of_rule$$\" | table index, number_of_rule, GB ]   XML: {     "type": "ds.search",     "options": {         "query": "| inputlookup xxxxxxx.csv\r\n| stats dc(title) as number_of_rule, values(title) as rules by category\r\n| map [| inputlookup yyyyyyyyy.csv\r\n| eval Date=strftime(_time, \\\"%m/%d/%Y\\\")\r\n| eval month=strftime(_time, \\\"%m\\\")\r\n| eval current_month=strftime(now(),\\\"%m\\\")\r\n| where month=current_month-1\r\n| search index=$$category$$\r\n| stats sum(GB) as GB by index\r\n| eval GB=round(GB,3)\r\n| eval index=\\\"$$category$$\\\", number_of_rule=\\\"$$number_of_rule$$\\\" | table index, number_of_rule, GB\r\n]"     },     "name": "Search_8" }   Thanks in advance! ... View more

Hi All, I am quite new to Phantom. I have written few plabooks which works perfectly as intended when run from the debugger. However, the issue is that, when the playbooks are called via automation, the playbooks start executing but stops in between before getting completed. There are error/warnings seen in the container. How is that the playbook runs fine when called manually from debugger but not when called by automation. Any leads would be appreciated. Thanks, Shaquib ... View more