I'm setting up the Exchange App, data is received in the correct indexes however I'm not seeing data in all the dashboards. one of my lookups is not populating which I believe could be the cause of some of the problems. The lookup seach is:
eventtype=msexchange-database-stats|stats latest(Active) as Active,latest(MasterType) as MasterType by host,Database|outputlookup dbInformation.csv
Which says no results (the job inspector says: This search has completed and found 55 matching events. However, the transforming commands in the highlighted portion of the following search)
If I run just (search eventtype=msexchange-database-stats | stats latest) results are produced.
Cheers