You can use a token modifier |s to escape double quotes.   $token$ $token|s$   The value of the tokens get parsed   asdf="asdf" "asdf=\"asdf\""   Unfortunately, this also adds double quotes around it, which makes this modifier useless in all my work.  I would have preferred only having 1 effect per modifier that can stack with others for those that want both, but this might work for others. The modifiers for tokens inside of alert action email bodies may not be available, but it will work in dashboards. Source: https://docs.splunk.com/Documentation/Splunk/9.1.2/Viz/tokens#Syntax_to_consume_tokens ... View more