spl-to-apl

แปลคำค้นหา Splunk SPL เป็น Axiom APL ให้การแมปคำสั่ง ฟังก์ชันที่เทียบเท่า และการแปลงไวยากรณ์ ใช้เมื่อย้ายจาก Splunk,…

npx skills add https://github.com/axiomhq/skills --skill spl-to-apl

SPL to APL Translator

Type safety: Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.

Critical Differences

Time is explicit in APL: SPL time pickers don't translate — add where _time between (ago(1h) .. now())
Structure: SPL index=... | command → APL ['dataset'] | operator
Join is preview: limited to 50k rows, inner/innerunique/leftouter only
cidrmatch args reversed: SPL cidrmatch(cidr, ip) → APL ipv4_is_in_range(ip, cidr)

Core Command Mappings

SPL	APL	Notes
`search index=...`	`['dataset']`	Dataset replaces index
`search field=value`	`where field == "value"`	Explicit where
`where`	`where`	Same
`stats`	`summarize`	Different aggregation syntax
`eval`	`extend`	Create/modify fields
`table` / `fields`	`project`	Select columns
`fields -`	`project-away`	Remove columns
`rename x as y`	`project-rename y = x`	Rename
`sort` / `sort -`	`order by ... asc/desc`	Sort
`head N`	`take N`	Limit rows
`top N field`	`summarize count() by field \| top N by count_`	Two-step
`dedup field`	`summarize arg_max(_time, *) by field`	Keep latest
`rex`	`parse` or `extract()`	Regex extraction
`join`	`join`	Preview feature
`append`	`union`	Combine datasets
`mvexpand`	`mv-expand`	Expand arrays
`timechart span=X`	`summarize ... by bin(_time, X)`	Manual binning
`rare N field`	`summarize count() by field \| order by count_ asc \| take N`	Bottom N
`spath`	`parse_json()` or `json['path']`	JSON access
`transaction`	No direct equivalent	Use summarize + make_list

Complete mappings: reference/command-mapping.md

Stats → Summarize

# SPL
| stats count by status

# APL  
| summarize count() by status

Key function mappings

SPL	APL
`count`	`count()`
`count(field)`	`countif(isnotnull(field))`
`dc(field)`	`dcount(field)`
`avg/sum/min/max`	Same
`median(field)`	`percentile(field, 50)`
`perc95(field)`	`percentile(field, 95)`
`first/last`	`arg_min/arg_max(_time, field)`
`list(field)`	`make_list(field)`
`values(field)`	`make_set(field)`

Conditional count pattern

# SPL
| stats count(eval(status>=500)) as errors by host

# APL
| summarize errors = countif(status >= 500) by host

Complete function list: reference/function-mapping.md

Eval → Extend

# SPL
| eval new_field = old_field * 2

# APL
| extend new_field = old_field * 2

Key function mappings

SPL	APL	Notes
`if(c, t, f)`	`iff(c, t, f)`	Double 'f'
`case(c1,v1,...)`	`case(c1,v1,...,default)`	Requires default
`len(str)`	`strlen(str)`
`lower/upper`	`tolower/toupper`
`substr`	`substring`	0-indexed in APL
`replace`	`replace_string`
`tonumber`	`toint/tolong/toreal`	Explicit types
`match(s,r)`	`s matches regex "r"`	Operator
`split(s, d)`	`split(s, d)`	Same
`mvjoin(mv, d)`	`strcat_array(arr, d)`	Join array
`mvcount(mv)`	`array_length(arr)`	Array length

Case statement pattern

# SPL
| eval level = case(
    status >= 500, "error",
    status >= 400, "warning",
    1==1, "ok"
  )

# APL  
| extend level = case(
    status >= 500, "error",
    status >= 400, "warning",
    "ok"
  )

Note: SPL's 1==1 catch-all becomes implicit default in APL.

Rex → Parse/Extract

# SPL
| rex field=message "user=(?<username>\w+)"

# APL - parse with regex
| parse kind=regex message with @"user=(?P<username>\w+)"

# APL - extract function  
| extend username = extract("user=(\\w+)", 1, message)

Simple pattern (non-regex)

# SPL
| rex field=uri "^/api/(?<version>v\d+)/(?<endpoint>\w+)"

# APL
| parse uri with "/api/" version "/" endpoint

Time Handling

SPL time pickers don't translate. Always add explicit time range:

# SPL (time picker: Last 24 hours)
index=logs

# APL
['logs'] | where _time between (ago(24h) .. now())

Timechart translation

# SPL
| timechart span=5m count by status

# APL
| summarize count() by bin(_time, 5m), status

Common Patterns

Error rate calculation

# SPL
| stats count(eval(status>=500)) as errors, count as total by host
| eval error_rate = errors/total*100

# APL
| summarize errors = countif(status >= 500), total = count() by host
| extend error_rate = toreal(errors) / total * 100

Subquery (subsearch)

# SPL
index=logs [search index=errors | fields user_id | format]

# APL
let error_users = ['errors'] | where _time between (ago(1h) .. now()) | distinct user_id;
['logs']
| where _time between (ago(1h) .. now())
| where user_id in (error_users)

Join datasets

# SPL
| join user_id [search index=users | fields user_id, name]

# APL
| join kind=inner (['users'] | project user_id, name) on user_id

Transaction-like grouping

# SPL
| transaction session_id maxspan=30m

# APL (no direct equivalent — reconstruct with summarize)
| summarize 
    start_time = min(_time),
    end_time = max(_time),
    events = make_list(pack("time", _time, "action", action)),
    duration = max(_time) - min(_time)
  by session_id
| where duration <= 30m

String Matching Performance

SPL	APL	Speed
`field="value"`	`field == "value"`	Fastest
`field="value"`	`field contains "value"`	Moderate
`field="value*"`	`field startswith "value"`	Fast
`match(field, regex)`	`field matches regex "..."`	Slowest