The value from the CommandLine field getting truncated.
I am use index search.
index=* source="process"
| table host CommandLine
The value is truncated in the table result field CommandLine
eg:
Input field
CommandLine= "-propertyfile=D:/projects/Testing/properties/perf "-Dtest_jvm_id=002 col 1" -Dbootstrap.folder=D:/projects/Testing/properties"
After search result:
CommandLine= "-propertyfile=D:/projects/Testing/properties/perf "
I need to remove the double quotes from the field like this "-propertyfile=D:/projects/Testing/properties/perf -Dtest_jvm_id=002 col 1-Dbootstrap.folder=D:/projects/Testing/properties"
It looks like CommandLine has been extracted normally although perhaps not as you had anticipated. Please share your raw event in a code block </>
Here is the sample raw text from the commandLine.
<>CommandLine="C:\appserver/java/8.0/bin/java -xxx.install.area=C:\appserver /YYYYYYYYY/properties/perf "-Dxxx_jvm_id=xxx col 12" -DDDDDDD.folder=D:/xxxxxxxx "-Dcolumn_identifier=xxx col 12" C:\appserver\profiles\XXXXX\config XXX WYYYYNxxx01 YYYYYYYYY"</>
I just want to remove the double quotes from the field values. I tried using Replace function, it did not work.