Thank you very much ... View more

Your eval commands are wrong. If you say | eval key=value You're telling Splunk to assign a value of a field named "value" to the field named "key". So if you do | eval value=4 | eval key=value The "key" field will have value of 4. But if you need to assign a literal value of "value" (in your case "FieldA.csv"), you need to enclose that value in quotes. | eval Filename="FieldA.csv" Otherwise, if you omit the quotes, Splunk will try to find an existing field called "FieldA.csv" and assign its value to the field "Filename". Since you don't have such field defined, the resulting field "Filename" will be null. ... View more