I created a transform to get rid of the backslashes in the values as mentioned in this bugreport:
https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc36977
Thought I'd throw it out here in case anyone needs it:
MV_ADD = 1
REGEX = (,\s|\\,)?(?<_KEY_1>[A-Za-z\-\s]+)=(?<_VAL_1>([^(,\s|\\,)]|\s)*)(,\s|\\,)?
Improved:
MV_ADD = 1
REGEX = (,\s|\,)?((?<_KEY_1>[A-Za-z-\s\d]+)=(?<_VAL_1>[^,]+(?!\,)))(,\s|\,)?
But still not complete
I took a different approach and removed the slashes instead. ISE 2.2.0.x still has this problem (bug linked to only 1.4.x)
[cisco:ise:syslog]
SEDCMD-strip_slash = s/\\\,/, /g
SEDCMD-strip_semicln = s/\\\;/;/g