Since 2020s the dropdown lookup moved to ITSI content pack app There is a content pack DA-ITSI-CP-unix-dashboards that contains an automatic lookup for some sourcetypes. The lookup is Lookup-dropdowns, relying on a csv lookup named dropdowns.csv. And coupled with an automatic lookup named "dropdownsLookup". The issue was that the csv lookup is not shipped with the app, but is being created/updated by a scheduled search "dropdowns_lookup_migrate" That scheduled search was running, but failed to create the lookup because of fields names issues. As a consequence, every time a search triggers the automatic lookup, the lookup throw an error because it does not find the csv file to load. To address the issue : - we ran the search "dropdowns_lookup_migrate" manually (without the append=t) to create the dropdowns lookup manually once to create the base lookup with the correct fields. If you have no entities, the lookup has only one line with "all_hosts". - then we waited for the search bundle to replicate to the indexers After that, the lookup error stopped.
... View more