conf-spl2-converter 0.1.9

A CLI tool for converting Splunk .conf configurations to SPL2

conf-spl2-converter

A CLI tool for converting Splunk .conf configurations (props.conf / transforms.conf) to SPL2 pipeline templates.

Installation

Requires Python 3.9+ and uv.

uv sync

Usage

Point the tool at a TA package directory that contains default/props.conf:

# Auto-discover all sourcetypes from props.conf (no config file needed)
uv run conf-spl2-converter generate /path/to/ta

# Use a config file to control which sourcetypes are processed and how
uv run conf-spl2-converter generate /path/to/ta -c field_extraction_config.json

# Write output to a custom directory
uv run conf-spl2-converter generate /path/to/ta -o /tmp/my-output

# Export parsed template data as JSON (useful for debugging / integration)
uv run conf-spl2-converter generate /path/to/ta -o /tmp/my-output -f json

# Combine all options with verbose logging
uv run conf-spl2-converter generate /path/to/ta -c config.json -o ./out -f spl2 -v

Config file

When --config / -c is not provided, the tool looks for field_extraction_config.json inside the TA directory. If found, it is used automatically. If not found, sourcetypes are auto-discovered from props.conf.

When --config / -c is provided, the specified config file is used instead (overrides the default lookup in the TA directory).

The config file controls which sourcetypes are processed along with extra settings like lookups, fields to trim, kv_mode overrides, etc.

Options

Flag	Short	Description
--config	-c	Path to a field_extraction_config.json. When omitted, looks for it in the TA directory; falls back to auto-discovery from props.conf.
--output	-o	Output directory for generated files. Defaults to <ta_path>/default/data/spl2/.
--format	-f	Output format: spl2 (default) or json.
--verbose	-v	Enable debug logging.
--version		Show version information.

Output formats

• spl2 (default) — renders .spl2 pipeline files ready for use in Splunk.
• json — writes a structured JSON file per sourcetype containing the parsed template data (extractions, evals, lookups, etc.).

Development

# Run tests
uv run pytest

# Lint and format
uv run ruff check .
uv run ruff format .

# Install pre-commit hooks
uv run pre-commit install