Hmmm
The first string (^ip dhcp snooping$) is correct, is should match "ip dhcp snooping".
To match ip dhcp snooping with any additional parameters , try "^ip dhcp snooping .+",, space between the "g" and the "."
Also alert should be "String is found"
try creating one search rule with an "or" vs "and"