diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml
index 54a9027bb5..2cd71209e8 100644
--- a/macros/splunkd_failed_auths.yml
+++ b/macros/splunkd_failed_auths.yml
@@ -1,4 +1,4 @@
-definition: index=_audit action="login attempt" info="failed"
+definition: index=_audit "action=login attempt" "info=failed"
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: splunkd_failed_auths
\ No newline at end of file