Agent skill · writing content · axiomhq
spl-to-apl
Translates Splunk SPL queries to Axiom APL. Provides command mappings, function equivalents, and syntax transformations. Use when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns.
Why this skill is useful
Provides detailed command mappings and syntax transformations specific to translating between Splunk SPL and Axiom APL, which the AI wouldn't reliably generate on its own.
What it needs
About 4k tokens when loaded. Last updated 2026-07-14. 14 stars on the source repository.
What this skill does
SPL to APL Translator Type safety: Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500. --- Critical Differences 1. Time is explicit in APL: SPL time pickers don't translate — add where time between (ago(1h) .. now()) 2. Structure: SPL index=... command → APL ['dataset'] operator 3. Join is preview: limited to 50k rows, inner/innerunique/leftouter only 4. cidrmatch args reversed: SPL cidrmatch(cidr, ip) → APL ipv4isinrange(ip, cidr) --- Core Command Mappings SPL APL Notes ----- ----- ------- search index=... ['dataset'] Dataset replaces index search field=value where field == "value" Explicit where where where Same stats summarize Different aggregation syntax eval extend Create/modify fields table / fields project Select columns fields - project-away Remove columns rename x as y project-rename y = x Rename sort / sort - order by ... asc/desc Sort head N take N Limit rows top N field summarize count() by field \ top N by count Two-step dedup field summarize argmax(time, ) by field Keep latest rex parse or extract() Regex extraction join join Preview feature append union Combine datasets mvexpand mv-expand Expand arrays timechart span=X summarize ... …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills axiomhq/spl-to-apl