SPL

SPL, the Search Processing Language, is Splunk's query language. A Splunk Enterprise Security detection is a scheduled search written in SPL that raises an alert. ESCU content ships as SPL searches wrapped in YAML, and contentctl builds and tests them.

What SPL means here

SPL pipes commands left to right, from a data selection to statistics and filters. Detections often lean on data models, so a rule's portability depends on the data model the team has mapped.

Teams moving between SIEMs often convert SPL rather than rewrite it. Sigma has a Splunk backend that goes the other way, from Sigma into SPL.

Example of SPL in Splunk Enterprise Security documentation

Splunk's ES 8 detections page describes detections as scheduled correlation searches written in SPL, and ESCU ships its content as Splunk searches. help.splunk.com read 2026-11-03

Terms related to SPL

• ESCU: ESCU is the Enterprise Security Content Update, the detection content Splunk ships for Enterprise Security.
• Detection rule: A detection rule is a stored query or logic that runs over security data and raises an alert when it matches.
• pySigma: pySigma is the Python library that parses Sigma rules and converts them into queries through installable backend and pipeline plugins.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.