Metadata-Version: 2.4
Name: conf-spl2-converter
Version: 0.1.9
Summary: A CLI tool for converting Splunk .conf configurations to SPL2
Project-URL: Homepage, https://splunk.com
Project-URL: Repository, https://github.com/splunk/conf-spl2-converter
Author-email: Splunk <mgazda@cisco.com>
License: Splunk Proprietary
License-File: LICENSE
Keywords: conf,converter,pipeline,spl2,splunk
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: License :: Other/Proprietary License
Classifier: Natural Language :: English
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Libraries
Classifier: Topic :: Utilities
Requires-Python: >=3.9
Requires-Dist: addonfactory-splunk-conf-parser-lib>=0.4
Requires-Dist: antlr4-python3-runtime>=4.13
Requires-Dist: typer>=0.12.0
Description-Content-Type: text/markdown

# conf-spl2-converter

A CLI tool for converting Splunk `.conf` configurations (props.conf / transforms.conf) to SPL2 pipeline templates.

## Installation

Requires Python 3.9+ and [uv](https://docs.astral.sh/uv/).

```bash
uv sync
```

## Usage

Point the tool at a TA package directory that contains `default/props.conf`:

```bash
# Auto-discover all sourcetypes from props.conf (no config file needed)
uv run conf-spl2-converter generate /path/to/ta

# Use a config file to control which sourcetypes are processed and how
uv run conf-spl2-converter generate /path/to/ta -c field_extraction_config.json

# Write output to a custom directory
uv run conf-spl2-converter generate /path/to/ta -o /tmp/my-output

# Export parsed template data as JSON (useful for debugging / integration)
uv run conf-spl2-converter generate /path/to/ta -o /tmp/my-output -f json

# Combine all options with verbose logging
uv run conf-spl2-converter generate /path/to/ta -c config.json -o ./out -f spl2 -v
```

### Config file

When `--config` / `-c` is **not** provided, the tool looks for `field_extraction_config.json` inside the TA directory. If found, it is used automatically. If not found, sourcetypes are auto-discovered from `props.conf`.

When `--config` / `-c` **is** provided, the specified config file is used instead (overrides the default lookup in the TA directory).

The config file controls which sourcetypes are processed along with extra settings like lookups, fields to trim, kv_mode overrides, etc.

### Options

| Flag | Short | Description |
|------|-------|-------------|
| `--config` | `-c` | Path to a `field_extraction_config.json`. When omitted, looks for it in the TA directory; falls back to auto-discovery from `props.conf`. |
| `--output` | `-o` | Output directory for generated files. Defaults to `<ta_path>/default/data/spl2/`. |
| `--format` | `-f` | Output format: `spl2` (default) or `json`. |
| `--verbose` | `-v` | Enable debug logging. |
| `--version` | | Show version information. |

### Output formats

- **`spl2`** (default) — renders `.spl2` pipeline files ready for use in Splunk.
- **`json`** — writes a structured JSON file per sourcetype containing the parsed template data (extractions, evals, lookups, etc.).

## Development

```bash
# Run tests
uv run pytest

# Lint and format
uv run ruff check .
uv run ruff format .

# Install pre-commit hooks
uv run pre-commit install
```
