6.2.2
Better handling for special characters in values
Historically (due to limitations in the Splunk target), special characters would be replaced (e.g. =
-> :
, "
-> ''
). This is problematic as it makes reproducing production issues harder (e.g. it is common to have = in an HTTP request query string)
Now, rather than replacing characters inside values, encapsulate them in quotes
There's a prioritized preference of quoting characters: ["
, '
, `
]