Splunk: use quoted parameter in request

Question

I have quoted parameters in log files, which are processed by Splunk:

"Version":"21"

How to extract that parameter to use in requests like this:

Version = "21" OR ...

Please note that it's no chance to modify current Splunk's config files.

Answer 1

Have you tried putting escaped quotes around the values, like

\"Version\" = "\"21\""

This may pick up on the quotes in the values.