# Spl To Apl

Translates Splunk SPL queries to Axiom APL.

- Repository: https://github.com/openclaw/clawhub (9543 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add openclaw/clawhub --skill spl-to-apl -g -a claude-code -y`
Codex: `npx skills add openclaw/clawhub --skill spl-to-apl -g -a codex -y`
Cursor: `npx skills add openclaw/clawhub --skill spl-to-apl -g -a cursor -y`
Gemini CLI: `npx skills add openclaw/clawhub --skill spl-to-apl -g -a gemini-cli -y`

## Description

Translates Splunk SPL queries to Axiom APL. Provides command mappings, function equivalents, and syntax transformations. Use when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SPL to APL Translator

**Type safety:** Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.

---

## Critical Differences

1. **Time is explicit in APL:** SPL time pickers don't translate, add `where _time between (ago(1h) .. now())`
2. **Structure:** SPL `index=... | command` → APL `['dataset'] | operator`
3. **Join is preview:** limited to 50k rows, inner/innerunique/leftouter only
4. **cidrmatch args reversed:** SPL `cidrmatch(cidr, ip)` → APL `ipv4_is_in_range(ip, cidr)`

---

## Core Command Mappings

| SPL | APL | Notes |
|-----|-----|-------|
| `search index=...` | `['dataset']` | Dataset replaces index |
| `search field=value` | `where field == "value"` | Explicit where |
| `where` | `where` | Same |
| `stats` | `summarize` | Different aggregation syntax |
| `eval` | `extend` | Create/modify fields |
| `table` / `fields` | `project` | Select columns |
| `fields -` | `project-away` | Remove columns |
| `rename x as y` | `project-rename y = x` | Rename |
| `sort` / `sort -` | `order by ... asc/desc` | Sort |
| `head N` | `take N` | Limit rows |
| `top N field` | `summarize count() by field \| top N by count_` | Two-step |
| `dedup field` | `summarize arg_max(_time, *) by field` | Keep latest |
| `rex` | `parse` or `extract()` | Regex extraction |
| `join` | `join` | **Preview feature** |
| `append` | `union` | Combine datasets |
| `mvexpand` | `mv-expand` | Expand arrays |
| `timechart span=X` | `summarize ... by bin(_time, X)` | Manual binning |
| `rare N field` | `summarize count() by field \| order by count_ asc \| take N` | Bottom N |
| `spath` | `parse_json()` or `json['path']` | JSON access |
| `transaction` | No direct equivalent | Use summarize + make_list |

Complete mappings: `reference/command-mapping.md`

---

## Stats → Summarize

```
# SPL
| stats count by status

# APL  
| summarize count() by status
```

### Key function mappings

The rest: https://github.com/openclaw/clawhub/blob/HEAD/.agents/skills/spl-to-apl/SKILL.md