In case anyone runs into the exact problem I had   error: Detected a reference cycle in lookups: fields = sourcetype <-- sourcetype; lookups = [ cisco:prime : LOOKUP-prime_alarms_field_description   Turns out this was an issue with the mentioned automatic lookup.  If you go to settings, automatic lookups, and search for it you can pull it up.  In my case this had "sourcetype" listed as an input field and an output field so I removed it from the output field and now we can search any sourcetype again. ... View more