Splunk Search

how to match multiple regex in splunk?

szone
Engager

hi all,

I have multiple string that are regex, i want to find logs that match with this string.
this is a example of my regex:
(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)

and when i write 
index="xyz" | regex "(?i)union.*?select.*?from | (?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)"
didn't show true result.

how can i write it? please help me.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Without knowing what you are actually trying to capture (some example events would be useful), it is difficult to say how it can be fixed, but in simple terms, a lot of the capture groups have not been closed, so simply adding some closing parentheses will make the regex valid, although it may not give you what you want

(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?))))))
0 Karma

szone
Engager

i want to capture strings matched with that regex and the regex is from good source and don't need to closing parentheses and i write part of the entire of string for summarize and example.
please help me.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than using non-capture groups (?:pattern) use capture groups (?<fieldname>pattern)

0 Karma

szone
Engager

please Explain in more detail. I'm new in splunk.
two of string is:
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\.\.sysdatabases|ysql\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\b|s(?:(?:ys(?:\.database_name|aux)|qlite(?:_temp)?_master)\b|chema(?:_name\b|\W*\())|d(?:atabas|b_nam)e\W*\())
 and
(?i)union.*?select.*?from
please help me

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @ITWhisperer said, to help you we are needing your sample data and explanation what you try to get from that sample (if it's not obviously based on your sample). Otherwise you could try it with https://regex101.com which also have option to save & share your regex.

r. Ismo

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Thanks for the Memories! Splunk University, .conf25, and our Community

Thank you to everyone in the Splunk Community who joined us for .conf25, which kicked off with our iconic ...