diff --git a/layouts/shortcodes/observability_pipelines/configure_existing_pipelines/destination_env_vars/splunk_hec.en.md b/layouts/shortcodes/observability_pipelines/configure_existing_pipelines/destination_env_vars/splunk_hec.en.md
index 7b92f053bbb62..114da600528a4 100644
--- a/layouts/shortcodes/observability_pipelines/configure_existing_pipelines/destination_env_vars/splunk_hec.en.md
+++ b/layouts/shortcodes/observability_pipelines/configure_existing_pipelines/destination_env_vars/splunk_hec.en.md
@@ -1,5 +1,5 @@
 - Splunk HEC token:
-    - The Splunk HEC token for the Splunk indexer.
+    - The Splunk HEC token for the Splunk indexer. **Note**: Depending on your shell and environment, you may want to to ensure the environment variable value is not wrapped in quotes.
     - Stored in the environment variable `DD_OP_DESTINATION_SPLUNK_HEC_TOKEN`.
 - Base URL of the Splunk instance:
     - The Splunk HTTP Event Collector endpoint your Observability Pipelines Worker sends processed logs to. For example, `https://hec.splunkcloud.com:8088`.  
diff --git a/layouts/shortcodes/observability_pipelines/prerequisites/splunk_hec_destination_only.en.md b/layouts/shortcodes/observability_pipelines/prerequisites/splunk_hec_destination_only.en.md
index 298bf00ce8926..ccc52d6616543 100644
--- a/layouts/shortcodes/observability_pipelines/prerequisites/splunk_hec_destination_only.en.md
+++ b/layouts/shortcodes/observability_pipelines/prerequisites/splunk_hec_destination_only.en.md
@@ -1,6 +1,6 @@
 To use Observability Pipelines' Splunk HEC destination, you have a Splunk Enterprise or Cloud instance configured with an HTTP Event Collector (HEC) input. You also have the following information available:
 
-- The Splunk HEC token.
+- The Splunk HEC token. **Note**: Depending on your shell and environment, you may want to to ensure the environment variable value is not wrapped in quotes.
 - The bind address that your Observability Pipelines Worker will listen on to receive logs from your applications. For example, `0.0.0.0:8080`. Later on, you [configure your applications](#send-logs-to-the-observability-pipelines-worker-over-splunk-hec) to send logs to this address.
 - The base URL of the Splunk instance that the Worker will send processed logs to. This URL should include the port that is globally configured for Splunk HTTP Event Collectors on your Splunk instance. For example, for Splunk Cloud: `https://prd-p-0mupp.splunkcloud.com:8088`.
 - If your HECs are globally configured to enable SSL, then you also need the appropriate [TLS certificates][3001] and password you used to create your private key file.