There doesn't appear to be anything in the SPL which would remove events from the list returned by the initial search so it is likely to be the custom command which is not returning events in some circumstances. ... View more

index=a host=b | table Message1,EventCode,Status | lookup blabla.csv Status EventCode OUTPUT action If the lookup is file based, you can check/uncheck the case sensitive box (in lookup definitions - advanced settings) ... View more

So, there is no "Status" field in the Lookup, that's why it didn't map. I assume the field "Error_Code" is what you want to map with the "Status" from Query 1. | lookup blabla.csv Status as "Error_Code" OUTPUT Action ... View more