spl-to-apl

bởi axiomhq

Dịch các truy vấn SPL của Splunk sang APL của Axiom. Cung cấp ánh xạ lệnh, tương đương hàm và chuyển đổi cú pháp. Sử dụng khi di chuyển từ Splunk,…

npx skills add https://github.com/axiomhq/skills --skill spl-to-apl

Tải ZIP GitHub

SPL to APL Translator

Type safety: Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.

Critical Differences

Time is explicit in APL: SPL time pickers don't translate — add where _time between (ago(1h) .. now())
Structure: SPL index=... | command → APL ['dataset'] | operator
Join is preview: limited to 50k rows, inner/innerunique/leftouter only
cidrmatch args reversed: SPL cidrmatch(cidr, ip) → APL ipv4_is_in_range(ip, cidr)

Core Command Mappings

SPL	APL	Notes
`search index=...`	`['dataset']`	Dataset replaces index
`search field=value`	`where field == "value"`	Explicit where
`where`	`where`	Same
`stats`	`summarize`	Different aggregation syntax
`eval`	`extend`	Create/modify fields
`table` / `fields`	`project`	Select columns
`fields -`	`project-away`	Remove columns
`rename x as y`	`project-rename y = x`	Rename
`sort` / `sort -`	`order by ... asc/desc`	Sort
`head N`	`take N`	Limit rows
`top N field`	`summarize count() by field \| top N by count_`	Two-step
`dedup field`	`summarize arg_max(_time, *) by field`	Keep latest
`rex`	`parse` or `extract()`	Regex extraction
`join`	`join`	Preview feature
`append`	`union`	Combine datasets
`mvexpand`	`mv-expand`	Expand arrays
`timechart span=X`	`summarize ... by bin(_time, X)`	Manual binning
`rare N field`	`summarize count() by field \| order by count_ asc \| take N`	Bottom N
`spath`	`parse_json()` or `json['path']`	JSON access
`transaction`	No direct equivalent	Use summarize + make_list

Complete mappings: reference/command-mapping.md

Stats → Summarize

# SPL
| stats count by status

# APL  
| summarize count() by status

Key function mappings

SPL	APL
`count`	`count()`
`count(field)`	`countif(isnotnull(field))`
`dc(field)`	`dcount(field)`
`avg/sum/min/max`	Same
`median(field)`	`percentile(field, 50)`
`perc95(field)`	`percentile(field, 95)`
`first/last`	`arg_min/arg_max(_time, field)`
`list(field)`	`make_list(field)`
`values(field)`	`make_set(field)`

Conditional count pattern

# SPL
| stats count(eval(status>=500)) as errors by host

# APL
| summarize errors = countif(status >= 500) by host

Complete function list: reference/function-mapping.md

Eval → Extend

# SPL
| eval new_field = old_field * 2

# APL
| extend new_field = old_field * 2

Key function mappings

SPL	APL	Notes
`if(c, t, f)`	`iff(c, t, f)`	Double 'f'
`case(c1,v1,...)`	`case(c1,v1,...,default)`	Requires default
`len(str)`	`strlen(str)`
`lower/upper`	`tolower/toupper`
`substr`	`substring`	0-indexed in APL
`replace`	`replace_string`
`tonumber`	`toint/tolong/toreal`	Explicit types
`match(s,r)`	`s matches regex "r"`	Operator
`split(s, d)`	`split(s, d)`	Same
`mvjoin(mv, d)`	`strcat_array(arr, d)`	Join array
`mvcount(mv)`	`array_length(arr)`	Array length

Case statement pattern

# SPL
| eval level = case(
    status >= 500, "error",
    status >= 400, "warning",
    1==1, "ok"
  )

# APL  
| extend level = case(
    status >= 500, "error",
    status >= 400, "warning",
    "ok"
  )

Note: SPL's 1==1 catch-all becomes implicit default in APL.

Rex → Parse/Extract

# SPL
| rex field=message "user=(?<username>\w+)"

# APL - parse with regex
| parse kind=regex message with @"user=(?P<username>\w+)"

# APL - extract function  
| extend username = extract("user=(\\w+)", 1, message)

Simple pattern (non-regex)

# SPL
| rex field=uri "^/api/(?<version>v\d+)/(?<endpoint>\w+)"

# APL
| parse uri with "/api/" version "/" endpoint

Time Handling

SPL time pickers don't translate. Always add explicit time range:

# SPL (time picker: Last 24 hours)
index=logs

# APL
['logs'] | where _time between (ago(24h) .. now())

Timechart translation

# SPL
| timechart span=5m count by status

# APL
| summarize count() by bin(_time, 5m), status

Common Patterns

Error rate calculation

# SPL
| stats count(eval(status>=500)) as errors, count as total by host
| eval error_rate = errors/total*100

# APL
| summarize errors = countif(status >= 500), total = count() by host
| extend error_rate = toreal(errors) / total * 100

Subquery (subsearch)

# SPL
index=logs [search index=errors | fields user_id | format]

# APL
let error_users = ['errors'] | where _time between (ago(1h) .. now()) | distinct user_id;
['logs']
| where _time between (ago(1h) .. now())
| where user_id in (error_users)

Join datasets

# SPL
| join user_id [search index=users | fields user_id, name]

# APL
| join kind=inner (['users'] | project user_id, name) on user_id

Transaction-like grouping

# SPL
| transaction session_id maxspan=30m

# APL (no direct equivalent — reconstruct with summarize)
| summarize 
    start_time = min(_time),
    end_time = max(_time),
    events = make_list(pack("time", _time, "action", action)),
    duration = max(_time) - min(_time)
  by session_id
| where duration <= 30m

String Matching Performance

SPL	APL	Speed
`field="value"`	`field == "value"`	Fastest
`field="value"`	`field contains "value"`	Moderate
`field="value*"`	`field startswith "value"`	Fast
`match(field, regex)`	`field matches regex "..."`	Slowest