https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-regex-expression-to-remove-quot-20-quot-and-more/m-p/434499#M124000 <P>The replace command should work:</P> <PRE><CODE>| eval Scanned=replace(Scanned,"^20|=20"," ") </CODE></PRE> Mon, 15 Oct 2018 17:15:36 GMT nrduren1115 2018-10-15T17:15:36Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-regex-expression-to-remove-quot-20-quot-and-more/m-p/434498#M123999 <P>So here are the results from my "Scanned" field:</P> <P>20Certificates.pdf<BR /><BR /> 20from=20GLA-PTX164760.pdf<BR /><BR /> 20from=20a=20Xerox.pdf<BR /><BR /> 20from=20a=20Xerox=20Multifunction=20Device.pdf <BR /> 20from=20a=20Xerox=20Multifunction=20Printer.pdf<BR /><BR /> 20from=20the=20DEU=20Xerox=20multifunction=20device=20at=20Work=20Area=201218.pdf</P> <P>I need a regex/extraction that can just give me the file name hidden in the text strings, like so...</P> <P>Certificates.pdf<BR /><BR /> GLA-PTX164760.pdf<BR /><BR /> Xerox.pdf<BR /><BR /> Xerox Multifunction Device.pdf<BR /><BR /> Xerox Multifunction Printer.pdf <BR /> Xerox multifunction device at Work Area 201218.pdf</P> Mon, 15 Oct 2018 17:12:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-regex-expression-to-remove-quot-20-quot-and-more/m-p/434498#M123999 dsmeerkat 2018-10-15T17:12:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-regex-expression-to-remove-quot-20-quot-and-more/m-p/434499#M124000 <P>The replace command should work:</P> <PRE><CODE>| eval Scanned=replace(Scanned,"^20|=20"," ") </CODE></PRE> Mon, 15 Oct 2018 17:15:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-make-a-regex-expression-to-remove-quot-20-quot-and-more/m-p/434499#M124000 nrduren1115 2018-10-15T17:15:36Z