lookup data not population in final part of query

[vk1544]

Hi all

i have the below query where i have a lookup  file with Error messages im trying to match the error messages in the lookup and then matching those in the rawdata and showing in table. However my final result query field is coming as empty rest all are populating. Need help in the query i was trying to add before the table command | lookup ErrorMessage.csv  query OUTPUT query but not working need help 

index=abc host="LINUX123" " source="/new/dir/apps/servers/service*.log"  "Error data*"  [ | inputlookup ErrorMessage.csv | fields + ErrorMessage | rename ErrorMessage as query] | table _time,host,query, _raw

lookup file content

ErrorMessage.csv

File Not Found

Error data in client transacton

thanks in advance 

[ITWhisperer]

The query field (like the search field) are special cases in subqueries as they are not passed to the outer search, only their values are. This is why the final query field is empty.