(a question from a customer) I have a field named string that reads: string="This is "an extraordinary" event, not to be missed." Splunk 4.2 extracts this as string="This is " , ignoring the rest of the value. Is there a way to format the input data/logging, such that the auto-kv will extract the entire string properly. The documentation describes how to escape backslash characters ( http://docs.splunk.com/Documentation/Splunk/4.2.3/admin/Propsconf ), can a similar approach be used to handle quotes? For example: key="i am having \"fun\" with splunk" I would prefer to use Splunk's auto-kv extraction to handle this (instead of writing a regex, as discussed in http://splunk-base.splunk.com/answers/23841/extract-with-quoted-values ). ... View more