{"id":24396,"library":"pysigma-backend-splunk","title":"pySigma Splunk Backend","description":"Generates Splunk Search Processing Language (SPL) from Sigma rules via the pySigma library. Supports SPL and SPL2 targets, Splunk Data Models, correlation rules, and field existence expressions. Compatible with pySigma >=1.0, Python >=3.10. Current version 2.1.0, release cadence is irregular.","status":"active","version":"2.1.0","language":"python","source_language":"en","source_url":"https://github.com/SigmaHQ/pySigma-backend-splunk","tags":["sigma","splunk","spl","spl2","pySigma","backend"],"install":[{"cmd":"pip install pysigma-backend-splunk","lang":"bash","label":"Install with pip"}],"dependencies":[{"reason":"Core library providing rule parsing and conversion pipeline.","package":"pySigma","optional":false}],"imports":[{"wrong":"from splunk import SplunkBackend","symbol":"SplunkBackend","correct":"from sigma.backends.splunk import SplunkBackend"}],"quickstart":{"code":"from sigma.collection import SigmaCollection\nfrom sigma.backends.splunk import SplunkBackend\n\n# Parse a simple Sigma rule\nrule = SigmaCollection.from_yaml('''\ntitle: Test\nstatus: test\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  sel:\n    Image|endswith: '\\\\cmd.exe'\n  condition: sel\n''')\n\nbackend = SplunkBackend()\nqueries = backend.convert(rule)\nfor q in queries:\n    print(q)","lang":"python","description":"Parse a Sigma rule and convert it to SPL using the Splunk backend."},"warnings":[{"fix":"Upgrade pySigma to >=1.0 and use pysigma-backend-splunk >=2.0.0.","message":"Version 2.0.0 is a major release requiring pySigma >=1.0. Older pySigma versions will cause import errors.","severity":"breaking","affected_versions":"<=1.1.3"},{"fix":"Use `SplunkBackend(output_format='spl2')` when you need SPL2 output.","message":"The SplunkBackend default output format is 'default' (SPL). To generate SPL2, you must pass `output_format='spl2'` to the constructor.","severity":"gotcha","affected_versions":"all"},{"fix":"Change imports from `sigma.plugins.splunk` to `sigma.backends.splunk`.","message":"Direct use of the old `splunk` subpackage from `sigma.plugins` is deprecated in pySigma 1.0. Use `sigma.backends.splunk` instead.","severity":"deprecated","affected_versions":">=2.0.0"}],"env_vars":null,"search_vec":"'1.0':34 '2.1.0':39 '3.10':36 'backend':3,49 'cadenc':41 'compat':31 'correl':25 'current':37 'data':23 'exist':29 'express':30 'field':28 'generat':4 'irregular':43 'languag':8 'librari':16 'model':24 'process':7 'pysigma':1,15,33,48 'python':35 'releas':40 'rule':12,26 'search':6 'sigma':11,44 'spl':9,18,46 'spl2':20,47 'splunk':2,5,22,45 'support':17 'target':21 'version':38 'via':13","created_at":"2026-05-01T08:12:51.781133+00:00","updated_at":"2026-05-01T08:12:51.781133+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"2.1.0","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/SigmaHQ/pySigma-backend-splunk","docs":null,"changelog":null,"pypi":"https://pypi.org/project/pysigma-backend-splunk/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["devops","observability"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-08-02","install_tag":null}}