Yeah, the field name has to be properties.operationName

And for those that are new to Cribl you could do it like this where my 1st function is just creating the fields and the event with an Eval Function and the 2nd function is a rename. There are countless ways to do this, but I figured I would share.

omg .... to easy ... thank you very much!