Hi karabsze, I had this email from Splunk Support back on March 4th.
Just an update on the issue.
We have fixed the issue of handling variable name with quoted values inside the quotes. This will be included in the next maintance release, 6.1.8, scheduled in the 2nd half of May.
Thank you for your patience on the matter, much appreciated and feel free to ask should you have any more questions on this.
Best regards,
Sung | Splunk Support
I got around the original problem by just using the first name so never tested to see if the issue remained post-6.1.8. Hope that helps.
... View more