How to return field value in double quotes

[neerajs_81]

Hi All,

In ES or in Splunk in general ,   How to return field value in double quotes ?   We have the below setting for "Drill Down Name"  which displays the Policy Name when alert is triggered.  I did like the Policy Name to be enclosed in double quotes when it displays in the alert though.  Any suggestions ?

Should i try this ?

\"$policy_name$\" 

[ITWhisperer · Accepted solution]

Try token filters

$policy_name|s$

https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters