---

name: spl-to-apl description: Translates Splunk SPL queries to Axiom APL. Provides command mappings, function equivalents, and syntax transformations. Use when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns.

SPL to APL Translator

Expert translator from Splunk Processing Language (SPL) to Axiom Processing Language (APL).

Translation Principles

1. Structure differs: SPL uses index=... | command | command. APL uses ['dataset'] | operator | operator
2. Time is explicit in APL: SPL time pickers don't translate — add where _time between (...) based on the intended range
3. Field names: SPL uses bare field, APL uses field or ['field.with.dots']
4. Pipe semantics are similar: Both flow data left-to-right through transformations
5. Verify before deploying: Test translated queries; some SPL behaviors have no direct APL equivalent

---

Command Mappings

Core Commands

---

Stats → Summarize Translation

Basic Pattern

Copy# SPL
| stats count by status

# APL  
| summarize count() by status

Aggregation Functions

Complex Stats Examples

Copy# SPL: Multiple aggregations
| stats count, avg(duration), max(bytes) by host

# APL
| summarize count(), avg(duration), max(bytes) by host

Copy# SPL: Conditional count
| stats count(eval(status>=500)) as errors by host

# APL
| summarize errors = countif(status >= 500) by host

Copy# SPL: Named aggregations
| stats count as total, dc(user) as unique_users by app

# APL
| summarize total = count(), unique_users = dcount(user) by app

---

Eval → Extend Translation

Basic Pattern

Copy# SPL
| eval new_field = old_field * 2

# APL
| extend new_field = old_field * 2

Function Mappings

Conditional Logic Examples

Copy# SPL: if statement
| eval severity = if(status >= 500, "error", "ok")

# APL
| extend severity = iff(status >= 500, "error", "ok")

Copy# SPL: case statement
| eval level = case(
    status >= 500, "error",
    status >= 400, "warning",
    1==1, "ok"
  )

# APL  
| extend level = case(
    status >= 500, "error",
    status >= 400, "warning",
    "ok"
  )

---

Time Handling

Time Range Translation

Copy# SPL (time picker: Last 24 hours)
index=logs

# APL (explicit time range required)
['logs'] | where _time between (ago(24h) .. now())

Timechart Translation

Copy# SPL
| timechart span=5m count by status

# APL
| summarize count() by bin(_time, 5m), status

Copy# SPL: Timechart with aggregation
| timechart span=1h avg(duration) as avg_duration

# APL
| summarize avg_duration = avg(duration) by bin(_time, 1h)

Time Functions

Time Literals

---

Rex → Parse/Extract Translation

Named Group Extraction

Copy# SPL
| rex field=message "user=(?<username>\w+)"

# APL - using parse with regex
| parse kind=regex message with @"user=(?P<username>\w+)"

# APL - using extract function  
| extend username = extract("user=(\\w+)", 1, message)

Pattern Extraction (Non-Regex)

Copy# SPL
| rex field=uri "^/api/(?<version>v\d+)/(?<endpoint>\w+)"

# APL
| parse uri with "/api/" version "/" endpoint

Multiple Captures

Copy# SPL
| rex field=log "src=(?<src_ip>\d+\.\d+\.\d+\.\d+).*dst=(?<dst_ip>\d+\.\d+\.\d+\.\d+)"

# APL
| extend src_ip = extract(@"src=(\d+\.\d+\.\d+\.\d+)", 1, log)
| extend dst_ip = extract(@"dst=(\d+\.\d+\.\d+\.\d+)", 1, log)

---

String Matching

Performance Tips

1. Use has over contains — word-boundary matching is faster
2. Use _cs variants — case-sensitive is faster (has_cs, contains_cs)
3. Avoid regex when simple operators work
4. Filter by time FIRST — always where _time between ... early

---

Common Query Translations

Error Count by Host

Copy# SPL
index=logs status>=500 
| stats count by host

# APL
['logs'] 
| where _time between (ago(1h) .. now())
| where status >= 500 
| summarize count() by host

Top 10 URIs

Copy# SPL
index=logs 
| top limit=10 uri

# APL
['logs']
| where _time between (ago(1h) .. now())
| summarize count() by uri
| top 10 by count_

Percentile Latency Over Time

Copy# SPL
index=logs 
| timechart span=5m perc95(duration) as p95

# APL
['logs']
| where _time between (ago(1h) .. now())
| summarize p95 = percentile(duration, 95) by bin(_time, 5m)

Error Rate Calculation

Copy# SPL
index=logs
| stats count(eval(status>=500)) as errors, count as total by host
| eval error_rate = errors/total*100

# APL
['logs']
| where _time between (ago(1h) .. now())
| summarize errors = countif(status >= 500), total = count() by host
| extend error_rate = toreal(errors) / total * 100

Dedup by User (Keep Latest)

Copy# SPL
index=logs 
| sort - _time 
| dedup user

# APL
['logs']
| where _time between (ago(1h) .. now())
| summarize arg_max(_time, *) by user

Transaction-like Grouping

Copy# SPL
index=logs 
| transaction session_id maxspan=30m

# APL
['logs']
| where _time between (ago(1h) .. now())
| summarize 
    start_time = min(_time),
    end_time = max(_time),
    events = make_list(pack("time", _time, "action", action)),
    duration = max(_time) - min(_time)
  by session_id

Join Datasets

Copy# SPL
index=logs 
| join user_id [search index=users | fields user_id, name, email]

# APL
['logs']
| where _time between (ago(1h) .. now())
| join kind=inner (['users']) on user_id

Subsearch / Subquery

Copy# SPL
index=logs [search index=errors | fields user_id | format]

# APL
let error_users = ['errors'] | where _time between (ago(1h) .. now()) | distinct user_id;
['logs']
| where _time between (ago(1h) .. now())
| where user_id in (error_users)

---

Field Escaping

SPL vs APL Field Names

Copy# SPL - dots in field names
kubernetes.pod.name="frontend"

# APL - bracket notation for dots (in where clause)
| where ['kubernetes.pod.name'] == "frontend"

Special Characters

Fields with dots that are part of the field name (not hierarchy) need escaping:

Copy// Field name literally contains "app.kubernetes.io"
| where ['kubernetes.labels.app\\.kubernetes\\.io/name'] == "frontend"

// Use getschema to discover exact field names
['dataset'] | where _time between (ago(1h) .. now()) | getschema

---

Reference

See reference/command-mapping.md for complete command list. See reference/function-mapping.md for complete function list.

For APL documentation: https://axiom.co/docs/apl/introduction For detailed operator docs: Use the axiom-sre skill references.