Double quotes possibly mess up the filtering

[bchris21]

Hello,

I am using Splunk_TA_Windows and enabled the option to query and ingest installed apps on hosts.

ParentCommandLine:
C:\windows\system32\cmd.exe /c ""C:\Program Files\SplunkUniversalForwarder\etc\apps\Splunk_TA_Windows\bin\win_installed_apps.bat""

You see that for a weird reason Splunk .bat path is 2 times double quoted.

The Event12 exclude filter I am using does not work probably because of the multiple quotes.

Specifically I am using:

<ParentCommandLine condition="contains">SplunkUniversalForwarder</ParentCommandLine>

Is there any way to escape them in the filter?

Thanks,

Chris