Search results

deferred expressions not applied in correlation rules

Status: Open.

#52 In SigmaHQ/pySigma-backend-splunk;

· arblade opened on Apr 2, 2025

Conditions added by processing pipelines are deferred with OR-ed regex

bugSomething isn't workingSomething isn't working

Status: Open.

#51 In SigmaHQ/pySigma-backend-splunk;

· thomaspatzke opened on Mar 19, 2025

Enhancement: Implement "|re" modifier for fields

Status: Open.

#44 In SigmaHQ/pySigma-backend-splunk;

· jabrcks opened on Aug 6, 2024

Directly interact with savedsearches.conf fields when using the savedsearches format

Status: Open.

#43 In SigmaHQ/pySigma-backend-splunk;

· joshnck opened on Jun 13, 2024

Problem in logical operator execution order : WHERE vs SEARCH

bugSomething isn't workingSomething isn't working

Status: Open.

#42 In SigmaHQ/pySigma-backend-splunk;

· IgorHrkswxryski opened on Jun 6, 2024

Convert correlation in savedsearches mode

bugSomething isn't workingSomething isn't working

Status: Open.

#41 In SigmaHQ/pySigma-backend-splunk;

· IgorHrkswxryski opened on May 7, 2024

Request: Using the fields: key to define the values() from a |stats command in correlation searches

Status: Open.

#40 In SigmaHQ/pySigma-backend-splunk;

· joshnck opened on Apr 17, 2024

ORing modifier <code>CIDR</code> error

bugSomething isn't workingSomething isn't working

Status: Open.

#35 In SigmaHQ/pySigma-backend-splunk;

· frack113 opened on Mar 12, 2024

Splunk backend allegedly doesn't support or conditions in regex, but fails to detect them (and for some reason creates a newline before | regex)

bugSomething isn't workingSomething isn't working

Status: Open.

#29 In SigmaHQ/pySigma-backend-splunk;

· joshnck opened on Jan 4, 2024

Question: How to avoid processing the fields?

enhancementNew feature or requestNew feature or request

Status: Open.

#27 In SigmaHQ/pySigma-backend-splunk;

· 0xFustang opened on Oct 20, 2023

[sigmac] [splunk] Unescaped . in query

bugSomething isn't workingSomething isn't working

Status: Open.

#15 In SigmaHQ/pySigma-backend-splunk;

· phantinuss opened on Sep 30, 2022