Splunk Search

how to match multiple regex in splunk?

szone
Engager

hi all,

I have multiple string that are regex, i want to find logs that match with this string.
this is a example of my regex:
(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)

and when i write 
index="xyz" | regex "(?i)union.*?select.*?from | (?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)"
didn't show true result.

how can i write it? please help me.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Without knowing what you are actually trying to capture (some example events would be useful), it is difficult to say how it can be fixed, but in simple terms, a lot of the capture groups have not been closed, so simply adding some closing parentheses will make the regex valid, although it may not give you what you want

(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?))))))
0 Karma

szone
Engager

i want to capture strings matched with that regex and the regex is from good source and don't need to closing parentheses and i write part of the entire of string for summarize and example.
please help me.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than using non-capture groups (?:pattern) use capture groups (?<fieldname>pattern)

0 Karma

szone
Engager

please Explain in more detail. I'm new in splunk.
two of string is:
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\.\.sysdatabases|ysql\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\b|s(?:(?:ys(?:\.database_name|aux)|qlite(?:_temp)?_master)\b|chema(?:_name\b|\W*\())|d(?:atabas|b_nam)e\W*\())
 and
(?i)union.*?select.*?from
please help me

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @ITWhisperer said, to help you we are needing your sample data and explanation what you try to get from that sample (if it's not obviously based on your sample). Otherwise you could try it with https://regex101.com which also have option to save & share your regex.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...