I went ahead and tried a different approach. I had each of the 749 files compressed as log.gz files beforehand. So just copied those compressed files to a directory on my Splunk instance and added a directory input. Worked like a charm !  ... View more

@ankit  The exact wording in documentation [1] (emphasis Splunk's): If the expression references a field name that contains non-alphanumeric characters, other than the underscore ( _ ) character, the field name needs to be surrounded by single quotation marks. For example, if the field name is server-1 you specify the field name like this new=count+'server-1'. I.e. Any character other then 0-9, A-Z, a-z, and _. 1. https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Eval ... View more

Thanks @gcusello . I was a little confused between the usage of lookup and inputlookup. Your answer and this post here cleared it up.  Also appreciate you pointing out the tip about using the 'index' field.  Thank you !  ... View more