https://community.splunk.com/t5/Getting-Data-In/HEC-replacing-underscore-with-space/m-p/553964#M91824 <P>I'm working with Proofpoint Threat Response events that are being sent to our instance of Splunk using an HEC connection.&nbsp; The part of the threat response event</P><P>&nbsp;</P><LI-CODE lang="markup">u'incident_field_values': [{u'name': u'Severity', u'value': u'Informational'},</LI-CODE><P>&nbsp;</P><P>The raw Splunk event</P><P>&nbsp;</P><LI-CODE lang="markup">"incident field values": [{"name": "Severity", "value": "Informational"},</LI-CODE><P>&nbsp;</P><P>As far as I know the HEC shouldn't do any translation so how did incident_field_values become the same name using spaces instead of underscores?&nbsp; The version is 7.3.6.</P><P>TIA,</P><P>Joe</P> Tue, 01 Jun 2021 20:42:41 GMT jwhughes58 2021-06-01T20:42:41Z https://community.splunk.com/t5/Getting-Data-In/HEC-replacing-underscore-with-space/m-p/553964#M91824 <P>I'm working with Proofpoint Threat Response events that are being sent to our instance of Splunk using an HEC connection.&nbsp; The part of the threat response event</P><P>&nbsp;</P><LI-CODE lang="markup">u'incident_field_values': [{u'name': u'Severity', u'value': u'Informational'},</LI-CODE><P>&nbsp;</P><P>The raw Splunk event</P><P>&nbsp;</P><LI-CODE lang="markup">"incident field values": [{"name": "Severity", "value": "Informational"},</LI-CODE><P>&nbsp;</P><P>As far as I know the HEC shouldn't do any translation so how did incident_field_values become the same name using spaces instead of underscores?&nbsp; The version is 7.3.6.</P><P>TIA,</P><P>Joe</P> Tue, 01 Jun 2021 20:42:41 GMT https://community.splunk.com/t5/Getting-Data-In/HEC-replacing-underscore-with-space/m-p/553964#M91824 jwhughes58 2021-06-01T20:42:41Z