Splunk Search

How do I make a regex expression to remove "=20" and more?

Explorer

So here are the results from my "Scanned" field:

20Certificates.pdf

20from=20GLA-PTX164760.pdf

20from=20a=20Xerox.pdf

20from=20a=20Xerox=20Multifunction=20Device.pdf
20from=20a=20Xerox=20Multifunction=20Printer.pdf

20from=20the=20DEU=20Xerox=20multifunction=20device=20at=20Work=20Area=201218.pdf

I need a regex/extraction that can just give me the file name hidden in the text strings, like so...

Certificates.pdf

GLA-PTX164760.pdf

Xerox.pdf

Xerox Multifunction Device.pdf

Xerox Multifunction Printer.pdf
Xerox multifunction device at Work Area 201218.pdf

Tags (2)
0 Karma

Explorer

The replace command should work:

| eval Scanned=replace(Scanned,"^20|=20"," ")
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!