Quoted escape characters when searching a field

[JoeSco27]

"2013-12-19 11:13:23", "[INFO]", "30927", "MainProcess", "SSMITH"

My data is coming into Splunk in this format, and when I select to look at it in raw form this is an example of one of my logs. The issue I am having is that when I want to search for a field I have to search for it in the following way or it wont show up:

levelname="\"[INFO]\""

I need the initial quotes around each field because some of the fields may have commas in them and the delimiter is also a comma. Is there a config I can use so I don't have to escape the quotes when searching for a field value? Or any advice besides changing the delimiter to fix the issue?

[somesoni2]

This could work for as an easiest options, but you need to include it in every search you make (as compare to search time field extraction suggested by @richgalloway, which you just configure once).

<your search starter index=blah sourcetype=blah> | replace "\"*\"" with "*" |<...rest of your search>

This will replace all the instance of '"value"' with 'value'.

[richgalloway]

Use a REGEX to parse the data. Put this in your transforms.conf file instead of DELIMS:

[<transformName>]
REGEX = \"(?<EventTime>.*?)\",\s\"(?<Level>.*?)\",\s\"(?<Field3>.*?)\",\s\"(?<Field4>.*?)\",\s\"(?<Field5>.*?)\"

[lukejadamec]

This is a search time field extraction in a config file (what you asked for). I'm not sure how to configure this to apply to only this field, but it would not surprise me if it's possible.

[JoeSco27]

I appreciate the quick response, but I would prefer not to have to do a index-time field extraction. Additionally, this is just a piece of my log, I have an additional 20 or so fields. Does anyone know of any other way around this? I could use this as a last resort but would rather not have to.