I am working with ES and the DVC_city filed is not populating which is derived from a lookup table file.
We have: checked the file, ensured the .csv format is correct etc, removed the fields for that particular data set and readded.
We added the data via the Lookup_editor. Upon troubleshooting, we received errors when we ran the following search: index=_internal (sourcetype=lookup_editor_rest_handler OR sourcetype=lookup_backups_rest_handler) INFO OR WARNING OR ERROR OR CRITICAL | rex field=_raw "(?<severity>(DEBUG)|(ERROR)|(WARNING)|(INFO)|(CRITICAL)) (?<message>.*)" | fillnull severity value="UNDEFINED" | search severity=ERROR