HTTP Event Collector: Why are double quotes not escaped for a properly formatted JSON string?

[unclethan]

A properly formatted JSON string will escape the double quotes. However the HEC does not translate that accordingly.

e.g JSON message to HEC: {"event":"somefield=\"a value with spaces\""}
the value for somefield is \"a value with spaces\"
when it should have the value a value with spaces

Any information on how to rectify this would be appreciated.

[gblock_splunk · Accepted solution]

This is fixed in the next version of Splunk, 6.4 which will be shipping very soon.

[IdoTwiggle]

Hi,

We're currently using Splunk version 6.4.1 and still experiencing this bug.
Can you verify if / on what version was it fixed to let us know what version should we upgrade to?

Thanks,
Ido