Registry / devops / pysigma-backend-splunk

pysigma-backend-splunk

library2.1.0pypypi✓ verified 83d ago

Generates Splunk Search Processing Language (SPL) from Sigma rules via the pySigma library. Supports SPL and SPL2 targets, Splunk Data Models, correlation rules, and field existence expressions. Compatible with pySigma >=1.0, Python >=3.10. Current version 2.1.0, release cadence is irregular.

devops observability

pip install pysigma-backend-splunk

github ↗package ↗

INSTALL

IMPORT

SIG · PYSIGMA-BACKEND-SP

pysigma-backend-splunk

devopspythonv2.1.0

Install

3.1s avg

Import

—

Disk

27MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v2.1.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 28.5MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 3.1s · import 0.000s · 30MB

27MB installed

● package 27MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

SplunkBackend

✓ from sigma.backends.splunk import SplunkBackend

✗ from splunk import SplunkBackend

Parse a Sigma rule and convert it to SPL using the Splunk backend.

from sigma.collection import SigmaCollection from sigma.backends.splunk import SplunkBackend # Parse a simple Sigma rule rule = SigmaCollection.from_yaml(''' title: Test status: test logsource: category: process_creation product: windows detection: sel: Image|endswith: '\\cmd.exe' condition: sel ''') backend = SplunkBackend() queries = backend.convert(rule) for q in queries: print(q)

Debug

Known issues

breakingVersion 2.0.0 is a major release requiring pySigma >=1.0. Older pySigma versions will cause import errors.

fix

Upgrade pySigma to >=1.0 and use pysigma-backend-splunk >=2.0.0.

affects: <=1.1.3

gotchaThe SplunkBackend default output format is 'default' (SPL). To generate SPL2, you must pass `output_format='spl2'` to the constructor.

fix

Use `SplunkBackend(output_format='spl2')` when you need SPL2 output.

affects: all

deprecatedDirect use of the old `splunk` subpackage from `sigma.plugins` is deprecated in pySigma 1.0. Use `sigma.backends.splunk` instead.

fix

Change imports from `sigma.plugins.splunk` to `sigma.backends.splunk`.

affects: >=2.0.0

Upgrade

Version history

2.1.0latest on PyPI · released Mar 22, 2026

Audit

Dependencies

pySigmarequiredCore library providing rule parsing and conversion pipeline.

Agent activity

28 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/SigmaHQ/pySigma-backend-splunk ↗

packagehttps://pypi.org/project/pysigma-backend-splunk/ ↗