Splunk Search

how to match multiple regex in splunk?

szone
Engager

hi all,

I have multiple string that are regex, i want to find logs that match with this string.
this is a example of my regex:
(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)

and when i write 
index="xyz" | regex "(?i)union.*?select.*?from | (?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)"
didn't show true result.

how can i write it? please help me.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Without knowing what you are actually trying to capture (some example events would be useful), it is difficult to say how it can be fixed, but in simple terms, a lot of the capture groups have not been closed, so simply adding some closing parentheses will make the regex valid, although it may not give you what you want

(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?))))))
0 Karma

szone
Engager

i want to capture strings matched with that regex and the regex is from good source and don't need to closing parentheses and i write part of the entire of string for summarize and example.
please help me.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than using non-capture groups (?:pattern) use capture groups (?<fieldname>pattern)

0 Karma

szone
Engager

please Explain in more detail. I'm new in splunk.
two of string is:
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\.\.sysdatabases|ysql\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\b|s(?:(?:ys(?:\.database_name|aux)|qlite(?:_temp)?_master)\b|chema(?:_name\b|\W*\())|d(?:atabas|b_nam)e\W*\())
 and
(?i)union.*?select.*?from
please help me

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @ITWhisperer said, to help you we are needing your sample data and explanation what you try to get from that sample (if it's not obviously based on your sample). Otherwise you could try it with https://regex101.com which also have option to save & share your regex.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...