Splunk Search

How do I make a regex expression to remove "=20" and more?

dsmeerkat
Explorer

So here are the results from my "Scanned" field:

20Certificates.pdf

20from=20GLA-PTX164760.pdf

20from=20a=20Xerox.pdf

20from=20a=20Xerox=20Multifunction=20Device.pdf
20from=20a=20Xerox=20Multifunction=20Printer.pdf

20from=20the=20DEU=20Xerox=20multifunction=20device=20at=20Work=20Area=201218.pdf

I need a regex/extraction that can just give me the file name hidden in the text strings, like so...

Certificates.pdf

GLA-PTX164760.pdf

Xerox.pdf

Xerox Multifunction Device.pdf

Xerox Multifunction Printer.pdf
Xerox multifunction device at Work Area 201218.pdf

Tags (2)
0 Karma

nrduren1115
Explorer

The replace command should work:

| eval Scanned=replace(Scanned,"^20|=20"," ")
0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...