Migration

Paste a Splunk search. Get SonQL.

SonQL is Splunk-inspired, not Splunk-compatible. Most of a search carries over word for word; the rest is a known list of differences, and this applies them for you and says which ones it applied. It runs in your browser. Nothing you paste leaves the page.

Splunk SPL

SonQL search2

index=web status=500 | stats count() as count by host | sort by count desc | limit 10

What changed, and why

semantics stats count needs parentheses, and is aliased as count: SonQL names the column count(), so a later sort by count would otherwise sort on nothing and return no rows, with no error.
semantics sort SonQL sorts descending by default (Splunk ascends), so the direction is written out.
renamed head head is limit in SonQL.

Try one

What it rewrites

stats count by host

stats count() as count by host

SonQL needs the parentheses, and names the column count(). Without the alias, a later sort by count sorts on a column that does not exist and returns no rows at all, with no error. That one is silent, which is why it comes first.

status=500 OR status=503 host=a

(status=500 OR status=503) host=a

Splunk evaluates OR before AND; SonQL evaluates AND first. Unparenthesised, the same search silently means something else, so the grouping Splunk implied is written out.

sort -errors

sort by errors desc

SonQL sorts descending by default and Splunk ascends, so every direction is written out rather than left to the default.

head 20 · table a b

limit 20 · fields a, b

Renamed, and field lists are comma-separated.

timechart span=1h count

timechart span="1h" count() as count

Option values are quoted: spans, join type="inner", maxspan="1m", input="_raw".

| streamstats count by host

search … | streamstats count() as count by host

SonQL has two engines. streamstats, lookup, accum and makemv run on search1 only, so the converter prefixes the query with search to select it.

What it will not do

Guess. A command it does not know is passed through and flagged unknown, and one SonQL does not have (appendcols, map, xyseries, …) is flagged unsupported with the nearest thing that exists.
Promise identical results. It makes a search parse and says what it changed. Some commands answer slightly differently on each engine — transaction names its added fields differently, for one — and those are noted where they apply.
Translate macros, lookups' contents or index-time config. Those are data, not syntax.

The full table, with each difference measured against a running instance, is in the handbook: Splunk → SonQL.