How to bucket fields with and without quotes together

[BlueBjorn]

A recent change to logs has broken my dashboard panels and reporting. I'm struggling to find the best way to modify my search criteria to pick up data prior to the change and after. It's a very simple change as single quotation marks were added around the field but it's giving me a big headache. 

index=prd sourcetype=core Step=* Time=* |  timechart avg(Time) by Step span=1d

Field in event log changed:

FROM: Step=CONVERSION_APPLICATION

TO: Step='CONVERSION_APPLICATION'  (with single quotation marks)

[BlueBjorn]

That worked. Thank you very much!! 

[richgalloway · Accepted solution]

Strip the quotes with the trim function.

index=prd sourcetype=core Step=* Time=* 
| eval Step=trim(Step, "'")
| timechart avg(Time) by Step span=1d