All Apps and Add-ons

Why is a field value which has double quotes getting truncated when writing the search?

Babuduraiswamy
Engager

The value from the CommandLine field getting truncated.

I am use index search.
index=* source="process" 
| table host CommandLine

The value is truncated in the table result field CommandLine

eg:
Input field
CommandLine= "-propertyfile=D:/projects/Testing/properties/perf "-Dtest_jvm_id=002 col 1" -Dbootstrap.folder=D:/projects/Testing/properties"

After search result:
CommandLine= "-propertyfile=D:/projects/Testing/properties/perf "

I need to remove the double quotes from the field like this "-propertyfile=D:/projects/Testing/properties/perf -Dtest_jvm_id=002 col 1-Dbootstrap.folder=D:/projects/Testing/properties"

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like CommandLine has been extracted normally although perhaps not as you had anticipated. Please share your raw event in a code block </> 

0 Karma

Babuduraiswamy
Engager

Here is the sample raw text from the commandLine.
<>CommandLine="C:\appserver/java/8.0/bin/java -xxx.install.area=C:\appserver /YYYYYYYYY/properties/perf "-Dxxx_jvm_id=xxx col 12" -DDDDDDD.folder=D:/xxxxxxxx "-Dcolumn_identifier=xxx col 12" C:\appserver\profiles\XXXXX\config XXX WYYYYNxxx01 YYYYYYYYY"</>

 

I just want to remove the double quotes from the field values. I tried using Replace function, it did not work.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...