Splunk Search

how to match multiple regex in splunk?

szone
Engager

hi all,

I have multiple string that are regex, i want to find logs that match with this string.
this is a example of my regex:
(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)

and when i write 
index="xyz" | regex "(?i)union.*?select.*?from | (?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)"
didn't show true result.

how can i write it? please help me.

Labels (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Without knowing what you are actually trying to capture (some example events would be useful), it is difficult to say how it can be fixed, but in simple terms, a lot of the capture groups have not been closed, so simply adding some closing parentheses will make the regex valid, although it may not give you what you want

(?i)union.*?select.*?from
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?))))))
0 Karma

szone
Engager

i want to capture strings matched with that regex and the regex is from good source and don't need to closing parentheses and i write part of the entire of string for summarize and example.
please help me.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Rather than using non-capture groups (?:pattern) use capture groups (?<fieldname>pattern)

0 Karma

szone
Engager

please Explain in more detail. I'm new in splunk.
two of string is:
(?i:\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\.\.sysdatabases|ysql\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\b|s(?:(?:ys(?:\.database_name|aux)|qlite(?:_temp)?_master)\b|chema(?:_name\b|\W*\())|d(?:atabas|b_nam)e\W*\())
 and
(?i)union.*?select.*?from
please help me

Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

as @ITWhisperer said, to help you we are needing your sample data and explanation what you try to get from that sample (if it's not obviously based on your sample). Otherwise you could try it with https://regex101.com which also have option to save & share your regex.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...