I am having a similar issue: here is my query
index=main source=source1 LOCATION_FULL_NAME=*
| dedup D
| fields ID, LOCATION_FULL_NAME
| lookup mergedLocationLookup.csv locationID as LOCATION_FULL_NAME output latitude, longitude, officeName , streetNumber, street, suite , neighborhood, city, zipCode, county, csa, state, region, country
| table INCIDENT_ID, LOCATION_FULL_NAME, latitude, longitude, officeName , streetNumber, street, suite , neighborhood, city, zipCode, county, csa, state, region, country
| stats count BY csa
| geom csa featureIdField="csa"
... View more