SPL to APL Translator

Type safety: Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.

---

Critical Differences

1. Time is explicit in APL: SPL time pickers don't translate, add where _time between (ago(1h) .. now())
2. Structure: SPL index=... | command → APL ['dataset'] | operator
3. Join is preview: limited to 50k rows, inner/innerunique/leftouter only
4. cidrmatch args reversed: SPL cidrmatch(cidr, ip) → APL ipv4_is_in_range(ip, cidr)

---

Core Command Mappings

SPL	APL	Notes
search index=...	['dataset']	Dataset replaces index
search field=value	where field == "value"	Explicit where
where	where	Same
stats	summarize	Different aggregation syntax
eval	extend	Create/modify fields
table / fields	project	Select columns
fields -	project-away	Remove columns
rename x as y	project-rename y = x	Rename
sort / sort -	order by ... asc/desc	Sort
head N	take N	Limit rows
top N field	summarize count() by field | top N by count_	Two-step
dedup field	summarize arg_max(_time, *) by field	Keep latest
rex	parse or extract()	Regex extraction
join	join	Preview feature
append	union	Combine datasets
mvexpand	mv-expand	Expand arrays
timechart span=X	summarize ... by bin(_time, X)	Manual binning
rare N field	summarize count() by field | order by count_ asc | take N	Bottom N
spath	parse_json() or json['path']	JSON access
transaction	No direct equivalent	Use summarize + make_list

Complete mappings: reference/command-mapping.md

---

Stats → Summarize

# SPL
| stats count by status

# APL  
| summarize count() by status

Key function mappings