Tests Coverage Badge Status

pySigma Splunk Backend

This is the Splunk backend for pySigma. It provides the package sigma.backends.splunk with the SplunkBackend class. Further, it contains the following processing pipelines in sigma.pipelines.splunk:

splunk_windows_pipeline: Splunk Windows log support
splunk_windows_sysmon_acceleration_keywords: Adds fiels name keyword search terms to generated query to accelerate search.

It supports the following output formats:

default: plain Splunk queries
savedsearches: Splunk savedsearches.conf format.

This backend is currently maintained by:

Thomas Patzke

Metadata

Release files for pysigma-backend-splunk 2.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for pysigma-backend-splunk 2.1.0
File	Size	Uploaded
pysigma_backend_splunk-2.1.0.tar.gz	18.7 kB	Mar 22, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for pysigma-backend-splunk 2.1.0
File	Interpreter	ABI	Platform	Reset
pysigma_backend_splunk-2.1.0-py3-none-any.whl 21.1 kB Mar 22, 2026	Python 3	none	any	Details

Total release size: 39.8 kB

Release files / pysigma_backend_splunk-2.1.0.tar.gz

Download URL	pysigma_backend_splunk-2.1.0.tar.gz
Size	18.7 kB
Tags	Source
SHA-256 checksum How to use checksums	`ca4d2d0e4c7f766a4daf551489ab20366578163e6ac838fc59bb6d3f2a1423e9`
BLAKE2b-256 checksum How to use checksums	`57f2a7bd243d9d597b52658cfb1c7bea415ffe7cb864cd12c5630e13f026781b`
Upload date	Mar 22, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/6.1.0 CPython/3.13.7`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/SigmaHQ/pySigma-backend-splunk
Publishing commit: github.com/SigmaHQ/pySigma-backend-splunk/tree/68a5e382f1d57a14337c6e66022af34da1e3bfe6

Workflow

Publishing configuration: github.com/SigmaHQ/pySigma-backend-splunk/blob/68a5e382f1d57a14337c6e66022af34da1e3bfe6/.github/workflows/release.yml
Publishing logs: github.com/SigmaHQ/pySigma-backend-splunk/actions/runs/23414349157/attempts/1

Artifact

Subject: pysigma_backend_splunk-2.1.0.tar.gz
SHA-256 checksum: ca4d2d0e4c7f766a4daf551489ab20366578163e6ac838fc59bb6d3f2a1423e9 Verifying attestations

Release files / pysigma_backend_splunk-2.1.0-py3-none-any.whl

Download URL	pysigma_backend_splunk-2.1.0-py3-none-any.whl
Size	21.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`90da654b17c7a396ba23af14a29ed559c562ae5bb60c4ceda47cd9744dd3581c`
BLAKE2b-256 checksum How to use checksums	`4138a2c7d959abcd6690f10d430707be1ed60de3ca406e0bd6af8f59e0a72439`
Upload date	Mar 22, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/6.1.0 CPython/3.13.7`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/SigmaHQ/pySigma-backend-splunk
Publishing commit: github.com/SigmaHQ/pySigma-backend-splunk/tree/68a5e382f1d57a14337c6e66022af34da1e3bfe6

Workflow

Publishing configuration: github.com/SigmaHQ/pySigma-backend-splunk/blob/68a5e382f1d57a14337c6e66022af34da1e3bfe6/.github/workflows/release.yml
Publishing logs: github.com/SigmaHQ/pySigma-backend-splunk/actions/runs/23414349157/attempts/1

Artifact

Subject: pysigma_backend_splunk-2.1.0-py3-none-any.whl
SHA-256 checksum: 90da654b17c7a396ba23af14a29ed559c562ae5bb60c4ceda47cd9744dd3581c Verifying attestations