use double quote around splunkable values instead of single quotes