Splunk Search

How do I make a regex expression to remove "=20" and more?

dsmeerkat
Explorer

So here are the results from my "Scanned" field:

20Certificates.pdf

20from=20GLA-PTX164760.pdf

20from=20a=20Xerox.pdf

20from=20a=20Xerox=20Multifunction=20Device.pdf
20from=20a=20Xerox=20Multifunction=20Printer.pdf

20from=20the=20DEU=20Xerox=20multifunction=20device=20at=20Work=20Area=201218.pdf

I need a regex/extraction that can just give me the file name hidden in the text strings, like so...

Certificates.pdf

GLA-PTX164760.pdf

Xerox.pdf

Xerox Multifunction Device.pdf

Xerox Multifunction Printer.pdf
Xerox multifunction device at Work Area 201218.pdf

Tags (2)
0 Karma

nrduren1115
Explorer

The replace command should work:

| eval Scanned=replace(Scanned,"^20|=20"," ")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...