Thanks PeteAve! I'll try that and see what happens.....  ... View more

Yea, smae same but different.   yesterday i applied this  and it started working too. s/(\\")/"/g   on the data but now i do not see it in the sourcetype advance option, if i add it again the log quality will ruin again. so not sure how the TA messed up. ... View more

Hi @youngec  Splunk passed me this released fix a few days ago, but I've not had the chance to try it yet. ------------------ The patch for this issue has been released in the following version 8.2.7.2. I have pasted the links below as per the engineering team. https://download.splunk.com/products/splunk/releases/8.2.7.2/linux/splunk-8.2.7.2-394c9ab9e27e-linux-2.6-amd64.deb https://download.splunk.com/products/splunk/releases/8.2.7.2/linux/splunk-8.2.7.2-394c9ab9e27e-linux-2.6-x86_64.rpm https://download.splunk.com/products/splunk/releases/8.2.7.2/linux/splunk-8.2.7.2-394c9ab9e27e-Linux-x86_64.tgz I also want to inform you that Splunk version 8.2.9(sustain/scootaloo) which has the bug fixed will be released in November month. ------------------------- Note, I checked and 8.2.7.2 is not yet up on the Splunk official download site. Check for any potential compatibility issues here: https://docs.splunk.com/Documentation/Splunk/8.2.7/Indexer/Systemrequirements#Splunk_Enterprise_version_compatibility ... View more