You can use a token modifier |s to escape double quotes.   $token$ $token|s$   The value of the tokens get parsed   asdf="asdf" "asdf=\"asdf\""   Unfortunately, this also adds double quotes around it, which makes this modifier useless in all my work.  I would have preferred only having 1 effect per modifier that can stack with others for those that want both, but this might work for others. The modifiers for tokens inside of alert action email bodies may not be available, but it will work in dashboards. Source: https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/tokens#Syntax_to_consume_tokens

The issue somewhat solved itself from one day to another without doing any modifications. I have digged into the _internal-index and logfiles on the UF without getting any indication why this suddenly startet to work. I will re-post if the error re-occurs.

I'm trying to build a custom app to parse the all these events and above field extraction into props and tranforms can you help me in adding all these extractions in to props.conf ? Sample Events: 2024-01-03 05:06:09,590  [TID:450] ERROR Thycotic.DistributedEngineRunner - Error getting Capabilities from Distributed Engine server - (null) System.NullReferenceException: Object reference not set to an instance of an object. TQ

Yes. Whenever your Splunk gets "locked" due to either exceeding your license quota too many times (in case of enforcing license) or moving past the license validity period, you need to install a one-time "unlock license" which you need to contact your Splunk sales contact about.