[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-axiom-spl-to-apl":3,"mdc--98pejy-key":34,"related-org-axiom-spl-to-apl":1728,"related-repo-axiom-spl-to-apl":1896},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":32,"mdContent":33},"spl-to-apl","translate Splunk SPL to Axiom APL","Translates Splunk SPL queries to Axiom APL. Provides command mappings, function equivalents, and syntax transformations. Use when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"axiom","Axiom","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faxiom.png","axiomhq",[13,17,18,21],{"name":14,"slug":15,"type":16},"Observability","observability","tag",{"name":9,"slug":8,"type":16},{"name":19,"slug":20,"type":16},"Migration","migration",{"name":22,"slug":23,"type":16},"APL","apl",11,"https:\u002F\u002Fgithub.com\u002Faxiomhq\u002Fskills","2026-04-06T18:04:20.939952",null,1,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":27},[],"https:\u002F\u002Fgithub.com\u002Faxiomhq\u002Fskills\u002Ftree\u002FHEAD\u002Fskills\u002Fspl-to-apl","---\nname: spl-to-apl\ndescription: Translates Splunk SPL queries to Axiom APL. Provides command mappings, function equivalents, and syntax transformations. Use when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns.\n---\n\n# SPL to APL Translator\n\n**Type safety:** Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.\n\n---\n\n## Critical Differences\n\n1. **Time is explicit in APL:** SPL time pickers don't translate — add `where _time between (ago(1h) .. now())`\n2. **Structure:** SPL `index=... | command` → APL `['dataset'] | operator`\n3. **Join is preview:** limited to 50k rows, inner\u002Finnerunique\u002Fleftouter only\n4. **cidrmatch args reversed:** SPL `cidrmatch(cidr, ip)` → APL `ipv4_is_in_range(ip, cidr)`\n\n---\n\n## Core Command Mappings\n\n| SPL | APL | Notes |\n|-----|-----|-------|\n| `search index=...` | `['dataset']` | Dataset replaces index |\n| `search field=value` | `where field == \"value\"` | Explicit where |\n| `where` | `where` | Same |\n| `stats` | `summarize` | Different aggregation syntax |\n| `eval` | `extend` | Create\u002Fmodify fields |\n| `table` \u002F `fields` | `project` | Select columns |\n| `fields -` | `project-away` | Remove columns |\n| `rename x as y` | `project-rename y = x` | Rename |\n| `sort` \u002F `sort -` | `order by ... asc\u002Fdesc` | Sort |\n| `head N` | `take N` | Limit rows |\n| `top N field` | `summarize count() by field \\| top N by count_` | Two-step |\n| `dedup field` | `summarize arg_max(_time, *) by field` | Keep latest |\n| `rex` | `parse` or `extract()` | Regex extraction |\n| `join` | `join` | **Preview feature** |\n| `append` | `union` | Combine datasets |\n| `mvexpand` | `mv-expand` | Expand arrays |\n| `timechart span=X` | `summarize ... by bin(_time, X)` | Manual binning |\n| `rare N field` | `summarize count() by field \\| order by count_ asc \\| take N` | Bottom N |\n| `spath` | `parse_json()` or `json['path']` | JSON access |\n| `transaction` | No direct equivalent | Use summarize + make_list |\n\nComplete mappings: `reference\u002Fcommand-mapping.md`\n\n---\n\n## Stats → Summarize\n\n```\n# SPL\n| stats count by status\n\n# APL  \n| summarize count() by status\n```\n\n### Key function mappings\n\n| SPL | APL |\n|-----|-----|\n| `count` | `count()` |\n| `count(field)` | `countif(isnotnull(field))` |\n| `dc(field)` | `dcount(field)` |\n| `avg\u002Fsum\u002Fmin\u002Fmax` | Same |\n| `median(field)` | `percentile(field, 50)` |\n| `perc95(field)` | `percentile(field, 95)` |\n| `first\u002Flast` | `arg_min\u002Farg_max(_time, field)` |\n| `list(field)` | `make_list(field)` |\n| `values(field)` | `make_set(field)` |\n\n### Conditional count pattern\n\n```\n# SPL\n| stats count(eval(status>=500)) as errors by host\n\n# APL\n| summarize errors = countif(status >= 500) by host\n```\n\nComplete function list: `reference\u002Ffunction-mapping.md`\n\n---\n\n## Eval → Extend\n\n```\n# SPL\n| eval new_field = old_field * 2\n\n# APL\n| extend new_field = old_field * 2\n```\n\n### Key function mappings\n\n| SPL | APL | Notes |\n|-----|-----|-------|\n| `if(c, t, f)` | `iff(c, t, f)` | Double 'f' |\n| `case(c1,v1,...)` | `case(c1,v1,...,default)` | Requires default |\n| `len(str)` | `strlen(str)` | |\n| `lower\u002Fupper` | `tolower\u002Ftoupper` | |\n| `substr` | `substring` | 0-indexed in APL |\n| `replace` | `replace_string` | |\n| `tonumber` | `toint\u002Ftolong\u002Ftoreal` | Explicit types |\n| `match(s,r)` | `s matches regex \"r\"` | Operator |\n| `split(s, d)` | `split(s, d)` | Same |\n| `mvjoin(mv, d)` | `strcat_array(arr, d)` | Join array |\n| `mvcount(mv)` | `array_length(arr)` | Array length |\n\n### Case statement pattern\n\n```\n# SPL\n| eval level = case(\n    status >= 500, \"error\",\n    status >= 400, \"warning\",\n    1==1, \"ok\"\n  )\n\n# APL  \n| extend level = case(\n    status >= 500, \"error\",\n    status >= 400, \"warning\",\n    \"ok\"\n  )\n```\n\nNote: SPL's `1==1` catch-all becomes implicit default in APL.\n\n---\n\n## Rex → Parse\u002FExtract\n\n```\n# SPL\n| rex field=message \"user=(?\u003Cusername>\\w+)\"\n\n# APL - parse with regex\n| parse kind=regex message with @\"user=(?P\u003Cusername>\\w+)\"\n\n# APL - extract function  \n| extend username = extract(\"user=(\\\\w+)\", 1, message)\n```\n\n### Simple pattern (non-regex)\n\n```\n# SPL\n| rex field=uri \"^\u002Fapi\u002F(?\u003Cversion>v\\d+)\u002F(?\u003Cendpoint>\\w+)\"\n\n# APL\n| parse uri with \"\u002Fapi\u002F\" version \"\u002F\" endpoint\n```\n\n---\n\n## Time Handling\n\nSPL time pickers don't translate. Always add explicit time range:\n\n```\n# SPL (time picker: Last 24 hours)\nindex=logs\n\n# APL\n['logs'] | where _time between (ago(24h) .. now())\n```\n\n### Timechart translation\n\n```\n# SPL\n| timechart span=5m count by status\n\n# APL\n| summarize count() by bin(_time, 5m), status\n```\n\n---\n\n## Common Patterns\n\n### Error rate calculation\n\n```\n# SPL\n| stats count(eval(status>=500)) as errors, count as total by host\n| eval error_rate = errors\u002Ftotal*100\n\n# APL\n| summarize errors = countif(status >= 500), total = count() by host\n| extend error_rate = toreal(errors) \u002F total * 100\n```\n\n### Subquery (subsearch)\n\n```\n# SPL\nindex=logs [search index=errors | fields user_id | format]\n\n# APL\nlet error_users = ['errors'] | where _time between (ago(1h) .. now()) | distinct user_id;\n['logs']\n| where _time between (ago(1h) .. now())\n| where user_id in (error_users)\n```\n\n### Join datasets\n\n```\n# SPL\n| join user_id [search index=users | fields user_id, name]\n\n# APL\n| join kind=inner (['users'] | project user_id, name) on user_id\n```\n\n### Transaction-like grouping\n\n```\n# SPL\n| transaction session_id maxspan=30m\n\n# APL (no direct equivalent — reconstruct with summarize)\n| summarize \n    start_time = min(_time),\n    end_time = max(_time),\n    events = make_list(pack(\"time\", _time, \"action\", action)),\n    duration = max(_time) - min(_time)\n  by session_id\n| where duration \u003C= 30m\n```\n\n---\n\n## String Matching Performance\n\n| SPL | APL | Speed |\n|-----|-----|-------|\n| `field=\"value\"` | `field == \"value\"` | **Fastest** |\n| `field=\"*value*\"` | `field contains \"value\"` | Moderate |\n| `field=\"value*\"` | `field startswith \"value\"` | Fast |\n| `match(field, regex)` | `field matches regex \"...\"` | **Slowest** |\n\nPrefer `has` over `contains` (word-boundary matching is faster). Use `_cs` variants for case-sensitive (faster).\n\n---\n\n## Reference\n\n- `reference\u002Fcommand-mapping.md` — complete command list\n- `reference\u002Ffunction-mapping.md` — complete function list  \n- `reference\u002Fexamples.md` — full query translation examples\n- APL docs: https:\u002F\u002Faxiom.co\u002Fdocs\u002Fapl\u002Fintroduction\n\n",{"data":35,"body":36},{"name":4,"description":6},{"type":37,"children":38},"root",[39,48,60,64,71,149,152,158,736,747,750,756,768,775,979,985,994,1005,1008,1014,1023,1028,1330,1336,1345,1358,1361,1367,1376,1382,1391,1394,1400,1405,1414,1420,1429,1432,1438,1444,1453,1459,1468,1474,1483,1489,1498,1501,1507,1642,1671,1674,1680],{"type":40,"tag":41,"props":42,"children":44},"element","h1",{"id":43},"spl-to-apl-translator",[45],{"type":46,"value":47},"text","SPL to APL Translator",{"type":40,"tag":49,"props":50,"children":51},"p",{},[52,58],{"type":40,"tag":53,"props":54,"children":55},"strong",{},[56],{"type":46,"value":57},"Type safety:",{"type":46,"value":59}," Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.",{"type":40,"tag":61,"props":62,"children":63},"hr",{},[],{"type":40,"tag":65,"props":66,"children":68},"h2",{"id":67},"critical-differences",[69],{"type":46,"value":70},"Critical Differences",{"type":40,"tag":72,"props":73,"children":74},"ol",{},[75,93,117,127],{"type":40,"tag":76,"props":77,"children":78},"li",{},[79,84,86],{"type":40,"tag":53,"props":80,"children":81},{},[82],{"type":46,"value":83},"Time is explicit in APL:",{"type":46,"value":85}," SPL time pickers don't translate — add ",{"type":40,"tag":87,"props":88,"children":90},"code",{"className":89},[],[91],{"type":46,"value":92},"where _time between (ago(1h) .. now())",{"type":40,"tag":76,"props":94,"children":95},{},[96,101,103,109,111],{"type":40,"tag":53,"props":97,"children":98},{},[99],{"type":46,"value":100},"Structure:",{"type":46,"value":102}," SPL ",{"type":40,"tag":87,"props":104,"children":106},{"className":105},[],[107],{"type":46,"value":108},"index=... | command",{"type":46,"value":110}," → APL ",{"type":40,"tag":87,"props":112,"children":114},{"className":113},[],[115],{"type":46,"value":116},"['dataset'] | operator",{"type":40,"tag":76,"props":118,"children":119},{},[120,125],{"type":40,"tag":53,"props":121,"children":122},{},[123],{"type":46,"value":124},"Join is preview:",{"type":46,"value":126}," limited to 50k rows, inner\u002Finnerunique\u002Fleftouter only",{"type":40,"tag":76,"props":128,"children":129},{},[130,135,136,142,143],{"type":40,"tag":53,"props":131,"children":132},{},[133],{"type":46,"value":134},"cidrmatch args reversed:",{"type":46,"value":102},{"type":40,"tag":87,"props":137,"children":139},{"className":138},[],[140],{"type":46,"value":141},"cidrmatch(cidr, ip)",{"type":46,"value":110},{"type":40,"tag":87,"props":144,"children":146},{"className":145},[],[147],{"type":46,"value":148},"ipv4_is_in_range(ip, cidr)",{"type":40,"tag":61,"props":150,"children":151},{},[],{"type":40,"tag":65,"props":153,"children":155},{"id":154},"core-command-mappings",[156],{"type":46,"value":157},"Core Command Mappings",{"type":40,"tag":159,"props":160,"children":161},"table",{},[162,185],{"type":40,"tag":163,"props":164,"children":165},"thead",{},[166],{"type":40,"tag":167,"props":168,"children":169},"tr",{},[170,176,180],{"type":40,"tag":171,"props":172,"children":173},"th",{},[174],{"type":46,"value":175},"SPL",{"type":40,"tag":171,"props":177,"children":178},{},[179],{"type":46,"value":22},{"type":40,"tag":171,"props":181,"children":182},{},[183],{"type":46,"value":184},"Notes",{"type":40,"tag":186,"props":187,"children":188},"tbody",{},[189,216,242,267,293,319,352,378,404,437,463,489,515,549,577,603,629,655,681,714],{"type":40,"tag":167,"props":190,"children":191},{},[192,202,211],{"type":40,"tag":193,"props":194,"children":195},"td",{},[196],{"type":40,"tag":87,"props":197,"children":199},{"className":198},[],[200],{"type":46,"value":201},"search index=...",{"type":40,"tag":193,"props":203,"children":204},{},[205],{"type":40,"tag":87,"props":206,"children":208},{"className":207},[],[209],{"type":46,"value":210},"['dataset']",{"type":40,"tag":193,"props":212,"children":213},{},[214],{"type":46,"value":215},"Dataset replaces index",{"type":40,"tag":167,"props":217,"children":218},{},[219,228,237],{"type":40,"tag":193,"props":220,"children":221},{},[222],{"type":40,"tag":87,"props":223,"children":225},{"className":224},[],[226],{"type":46,"value":227},"search field=value",{"type":40,"tag":193,"props":229,"children":230},{},[231],{"type":40,"tag":87,"props":232,"children":234},{"className":233},[],[235],{"type":46,"value":236},"where field == \"value\"",{"type":40,"tag":193,"props":238,"children":239},{},[240],{"type":46,"value":241},"Explicit where",{"type":40,"tag":167,"props":243,"children":244},{},[245,254,262],{"type":40,"tag":193,"props":246,"children":247},{},[248],{"type":40,"tag":87,"props":249,"children":251},{"className":250},[],[252],{"type":46,"value":253},"where",{"type":40,"tag":193,"props":255,"children":256},{},[257],{"type":40,"tag":87,"props":258,"children":260},{"className":259},[],[261],{"type":46,"value":253},{"type":40,"tag":193,"props":263,"children":264},{},[265],{"type":46,"value":266},"Same",{"type":40,"tag":167,"props":268,"children":269},{},[270,279,288],{"type":40,"tag":193,"props":271,"children":272},{},[273],{"type":40,"tag":87,"props":274,"children":276},{"className":275},[],[277],{"type":46,"value":278},"stats",{"type":40,"tag":193,"props":280,"children":281},{},[282],{"type":40,"tag":87,"props":283,"children":285},{"className":284},[],[286],{"type":46,"value":287},"summarize",{"type":40,"tag":193,"props":289,"children":290},{},[291],{"type":46,"value":292},"Different aggregation syntax",{"type":40,"tag":167,"props":294,"children":295},{},[296,305,314],{"type":40,"tag":193,"props":297,"children":298},{},[299],{"type":40,"tag":87,"props":300,"children":302},{"className":301},[],[303],{"type":46,"value":304},"eval",{"type":40,"tag":193,"props":306,"children":307},{},[308],{"type":40,"tag":87,"props":309,"children":311},{"className":310},[],[312],{"type":46,"value":313},"extend",{"type":40,"tag":193,"props":315,"children":316},{},[317],{"type":46,"value":318},"Create\u002Fmodify fields",{"type":40,"tag":167,"props":320,"children":321},{},[322,338,347],{"type":40,"tag":193,"props":323,"children":324},{},[325,330,332],{"type":40,"tag":87,"props":326,"children":328},{"className":327},[],[329],{"type":46,"value":159},{"type":46,"value":331}," \u002F ",{"type":40,"tag":87,"props":333,"children":335},{"className":334},[],[336],{"type":46,"value":337},"fields",{"type":40,"tag":193,"props":339,"children":340},{},[341],{"type":40,"tag":87,"props":342,"children":344},{"className":343},[],[345],{"type":46,"value":346},"project",{"type":40,"tag":193,"props":348,"children":349},{},[350],{"type":46,"value":351},"Select columns",{"type":40,"tag":167,"props":353,"children":354},{},[355,364,373],{"type":40,"tag":193,"props":356,"children":357},{},[358],{"type":40,"tag":87,"props":359,"children":361},{"className":360},[],[362],{"type":46,"value":363},"fields -",{"type":40,"tag":193,"props":365,"children":366},{},[367],{"type":40,"tag":87,"props":368,"children":370},{"className":369},[],[371],{"type":46,"value":372},"project-away",{"type":40,"tag":193,"props":374,"children":375},{},[376],{"type":46,"value":377},"Remove columns",{"type":40,"tag":167,"props":379,"children":380},{},[381,390,399],{"type":40,"tag":193,"props":382,"children":383},{},[384],{"type":40,"tag":87,"props":385,"children":387},{"className":386},[],[388],{"type":46,"value":389},"rename x as y",{"type":40,"tag":193,"props":391,"children":392},{},[393],{"type":40,"tag":87,"props":394,"children":396},{"className":395},[],[397],{"type":46,"value":398},"project-rename y = x",{"type":40,"tag":193,"props":400,"children":401},{},[402],{"type":46,"value":403},"Rename",{"type":40,"tag":167,"props":405,"children":406},{},[407,423,432],{"type":40,"tag":193,"props":408,"children":409},{},[410,416,417],{"type":40,"tag":87,"props":411,"children":413},{"className":412},[],[414],{"type":46,"value":415},"sort",{"type":46,"value":331},{"type":40,"tag":87,"props":418,"children":420},{"className":419},[],[421],{"type":46,"value":422},"sort -",{"type":40,"tag":193,"props":424,"children":425},{},[426],{"type":40,"tag":87,"props":427,"children":429},{"className":428},[],[430],{"type":46,"value":431},"order by ... asc\u002Fdesc",{"type":40,"tag":193,"props":433,"children":434},{},[435],{"type":46,"value":436},"Sort",{"type":40,"tag":167,"props":438,"children":439},{},[440,449,458],{"type":40,"tag":193,"props":441,"children":442},{},[443],{"type":40,"tag":87,"props":444,"children":446},{"className":445},[],[447],{"type":46,"value":448},"head N",{"type":40,"tag":193,"props":450,"children":451},{},[452],{"type":40,"tag":87,"props":453,"children":455},{"className":454},[],[456],{"type":46,"value":457},"take N",{"type":40,"tag":193,"props":459,"children":460},{},[461],{"type":46,"value":462},"Limit rows",{"type":40,"tag":167,"props":464,"children":465},{},[466,475,484],{"type":40,"tag":193,"props":467,"children":468},{},[469],{"type":40,"tag":87,"props":470,"children":472},{"className":471},[],[473],{"type":46,"value":474},"top N field",{"type":40,"tag":193,"props":476,"children":477},{},[478],{"type":40,"tag":87,"props":479,"children":481},{"className":480},[],[482],{"type":46,"value":483},"summarize count() by field | top N by count_",{"type":40,"tag":193,"props":485,"children":486},{},[487],{"type":46,"value":488},"Two-step",{"type":40,"tag":167,"props":490,"children":491},{},[492,501,510],{"type":40,"tag":193,"props":493,"children":494},{},[495],{"type":40,"tag":87,"props":496,"children":498},{"className":497},[],[499],{"type":46,"value":500},"dedup field",{"type":40,"tag":193,"props":502,"children":503},{},[504],{"type":40,"tag":87,"props":505,"children":507},{"className":506},[],[508],{"type":46,"value":509},"summarize arg_max(_time, *) by field",{"type":40,"tag":193,"props":511,"children":512},{},[513],{"type":46,"value":514},"Keep latest",{"type":40,"tag":167,"props":516,"children":517},{},[518,527,544],{"type":40,"tag":193,"props":519,"children":520},{},[521],{"type":40,"tag":87,"props":522,"children":524},{"className":523},[],[525],{"type":46,"value":526},"rex",{"type":40,"tag":193,"props":528,"children":529},{},[530,536,538],{"type":40,"tag":87,"props":531,"children":533},{"className":532},[],[534],{"type":46,"value":535},"parse",{"type":46,"value":537}," or ",{"type":40,"tag":87,"props":539,"children":541},{"className":540},[],[542],{"type":46,"value":543},"extract()",{"type":40,"tag":193,"props":545,"children":546},{},[547],{"type":46,"value":548},"Regex extraction",{"type":40,"tag":167,"props":550,"children":551},{},[552,561,569],{"type":40,"tag":193,"props":553,"children":554},{},[555],{"type":40,"tag":87,"props":556,"children":558},{"className":557},[],[559],{"type":46,"value":560},"join",{"type":40,"tag":193,"props":562,"children":563},{},[564],{"type":40,"tag":87,"props":565,"children":567},{"className":566},[],[568],{"type":46,"value":560},{"type":40,"tag":193,"props":570,"children":571},{},[572],{"type":40,"tag":53,"props":573,"children":574},{},[575],{"type":46,"value":576},"Preview feature",{"type":40,"tag":167,"props":578,"children":579},{},[580,589,598],{"type":40,"tag":193,"props":581,"children":582},{},[583],{"type":40,"tag":87,"props":584,"children":586},{"className":585},[],[587],{"type":46,"value":588},"append",{"type":40,"tag":193,"props":590,"children":591},{},[592],{"type":40,"tag":87,"props":593,"children":595},{"className":594},[],[596],{"type":46,"value":597},"union",{"type":40,"tag":193,"props":599,"children":600},{},[601],{"type":46,"value":602},"Combine datasets",{"type":40,"tag":167,"props":604,"children":605},{},[606,615,624],{"type":40,"tag":193,"props":607,"children":608},{},[609],{"type":40,"tag":87,"props":610,"children":612},{"className":611},[],[613],{"type":46,"value":614},"mvexpand",{"type":40,"tag":193,"props":616,"children":617},{},[618],{"type":40,"tag":87,"props":619,"children":621},{"className":620},[],[622],{"type":46,"value":623},"mv-expand",{"type":40,"tag":193,"props":625,"children":626},{},[627],{"type":46,"value":628},"Expand arrays",{"type":40,"tag":167,"props":630,"children":631},{},[632,641,650],{"type":40,"tag":193,"props":633,"children":634},{},[635],{"type":40,"tag":87,"props":636,"children":638},{"className":637},[],[639],{"type":46,"value":640},"timechart span=X",{"type":40,"tag":193,"props":642,"children":643},{},[644],{"type":40,"tag":87,"props":645,"children":647},{"className":646},[],[648],{"type":46,"value":649},"summarize ... by bin(_time, X)",{"type":40,"tag":193,"props":651,"children":652},{},[653],{"type":46,"value":654},"Manual binning",{"type":40,"tag":167,"props":656,"children":657},{},[658,667,676],{"type":40,"tag":193,"props":659,"children":660},{},[661],{"type":40,"tag":87,"props":662,"children":664},{"className":663},[],[665],{"type":46,"value":666},"rare N field",{"type":40,"tag":193,"props":668,"children":669},{},[670],{"type":40,"tag":87,"props":671,"children":673},{"className":672},[],[674],{"type":46,"value":675},"summarize count() by field | order by count_ asc | take N",{"type":40,"tag":193,"props":677,"children":678},{},[679],{"type":46,"value":680},"Bottom N",{"type":40,"tag":167,"props":682,"children":683},{},[684,693,709],{"type":40,"tag":193,"props":685,"children":686},{},[687],{"type":40,"tag":87,"props":688,"children":690},{"className":689},[],[691],{"type":46,"value":692},"spath",{"type":40,"tag":193,"props":694,"children":695},{},[696,702,703],{"type":40,"tag":87,"props":697,"children":699},{"className":698},[],[700],{"type":46,"value":701},"parse_json()",{"type":46,"value":537},{"type":40,"tag":87,"props":704,"children":706},{"className":705},[],[707],{"type":46,"value":708},"json['path']",{"type":40,"tag":193,"props":710,"children":711},{},[712],{"type":46,"value":713},"JSON access",{"type":40,"tag":167,"props":715,"children":716},{},[717,726,731],{"type":40,"tag":193,"props":718,"children":719},{},[720],{"type":40,"tag":87,"props":721,"children":723},{"className":722},[],[724],{"type":46,"value":725},"transaction",{"type":40,"tag":193,"props":727,"children":728},{},[729],{"type":46,"value":730},"No direct equivalent",{"type":40,"tag":193,"props":732,"children":733},{},[734],{"type":46,"value":735},"Use summarize + make_list",{"type":40,"tag":49,"props":737,"children":738},{},[739,741],{"type":46,"value":740},"Complete mappings: ",{"type":40,"tag":87,"props":742,"children":744},{"className":743},[],[745],{"type":46,"value":746},"reference\u002Fcommand-mapping.md",{"type":40,"tag":61,"props":748,"children":749},{},[],{"type":40,"tag":65,"props":751,"children":753},{"id":752},"stats-summarize",[754],{"type":46,"value":755},"Stats → Summarize",{"type":40,"tag":757,"props":758,"children":762},"pre",{"className":759,"code":761,"language":46},[760],"language-text","# SPL\n| stats count by status\n\n# APL  \n| summarize count() by status\n",[763],{"type":40,"tag":87,"props":764,"children":766},{"__ignoreMap":765},"",[767],{"type":46,"value":761},{"type":40,"tag":769,"props":770,"children":772},"h3",{"id":771},"key-function-mappings",[773],{"type":46,"value":774},"Key function mappings",{"type":40,"tag":159,"props":776,"children":777},{},[778,792],{"type":40,"tag":163,"props":779,"children":780},{},[781],{"type":40,"tag":167,"props":782,"children":783},{},[784,788],{"type":40,"tag":171,"props":785,"children":786},{},[787],{"type":46,"value":175},{"type":40,"tag":171,"props":789,"children":790},{},[791],{"type":46,"value":22},{"type":40,"tag":186,"props":793,"children":794},{},[795,816,837,858,874,895,916,937,958],{"type":40,"tag":167,"props":796,"children":797},{},[798,807],{"type":40,"tag":193,"props":799,"children":800},{},[801],{"type":40,"tag":87,"props":802,"children":804},{"className":803},[],[805],{"type":46,"value":806},"count",{"type":40,"tag":193,"props":808,"children":809},{},[810],{"type":40,"tag":87,"props":811,"children":813},{"className":812},[],[814],{"type":46,"value":815},"count()",{"type":40,"tag":167,"props":817,"children":818},{},[819,828],{"type":40,"tag":193,"props":820,"children":821},{},[822],{"type":40,"tag":87,"props":823,"children":825},{"className":824},[],[826],{"type":46,"value":827},"count(field)",{"type":40,"tag":193,"props":829,"children":830},{},[831],{"type":40,"tag":87,"props":832,"children":834},{"className":833},[],[835],{"type":46,"value":836},"countif(isnotnull(field))",{"type":40,"tag":167,"props":838,"children":839},{},[840,849],{"type":40,"tag":193,"props":841,"children":842},{},[843],{"type":40,"tag":87,"props":844,"children":846},{"className":845},[],[847],{"type":46,"value":848},"dc(field)",{"type":40,"tag":193,"props":850,"children":851},{},[852],{"type":40,"tag":87,"props":853,"children":855},{"className":854},[],[856],{"type":46,"value":857},"dcount(field)",{"type":40,"tag":167,"props":859,"children":860},{},[861,870],{"type":40,"tag":193,"props":862,"children":863},{},[864],{"type":40,"tag":87,"props":865,"children":867},{"className":866},[],[868],{"type":46,"value":869},"avg\u002Fsum\u002Fmin\u002Fmax",{"type":40,"tag":193,"props":871,"children":872},{},[873],{"type":46,"value":266},{"type":40,"tag":167,"props":875,"children":876},{},[877,886],{"type":40,"tag":193,"props":878,"children":879},{},[880],{"type":40,"tag":87,"props":881,"children":883},{"className":882},[],[884],{"type":46,"value":885},"median(field)",{"type":40,"tag":193,"props":887,"children":888},{},[889],{"type":40,"tag":87,"props":890,"children":892},{"className":891},[],[893],{"type":46,"value":894},"percentile(field, 50)",{"type":40,"tag":167,"props":896,"children":897},{},[898,907],{"type":40,"tag":193,"props":899,"children":900},{},[901],{"type":40,"tag":87,"props":902,"children":904},{"className":903},[],[905],{"type":46,"value":906},"perc95(field)",{"type":40,"tag":193,"props":908,"children":909},{},[910],{"type":40,"tag":87,"props":911,"children":913},{"className":912},[],[914],{"type":46,"value":915},"percentile(field, 95)",{"type":40,"tag":167,"props":917,"children":918},{},[919,928],{"type":40,"tag":193,"props":920,"children":921},{},[922],{"type":40,"tag":87,"props":923,"children":925},{"className":924},[],[926],{"type":46,"value":927},"first\u002Flast",{"type":40,"tag":193,"props":929,"children":930},{},[931],{"type":40,"tag":87,"props":932,"children":934},{"className":933},[],[935],{"type":46,"value":936},"arg_min\u002Farg_max(_time, field)",{"type":40,"tag":167,"props":938,"children":939},{},[940,949],{"type":40,"tag":193,"props":941,"children":942},{},[943],{"type":40,"tag":87,"props":944,"children":946},{"className":945},[],[947],{"type":46,"value":948},"list(field)",{"type":40,"tag":193,"props":950,"children":951},{},[952],{"type":40,"tag":87,"props":953,"children":955},{"className":954},[],[956],{"type":46,"value":957},"make_list(field)",{"type":40,"tag":167,"props":959,"children":960},{},[961,970],{"type":40,"tag":193,"props":962,"children":963},{},[964],{"type":40,"tag":87,"props":965,"children":967},{"className":966},[],[968],{"type":46,"value":969},"values(field)",{"type":40,"tag":193,"props":971,"children":972},{},[973],{"type":40,"tag":87,"props":974,"children":976},{"className":975},[],[977],{"type":46,"value":978},"make_set(field)",{"type":40,"tag":769,"props":980,"children":982},{"id":981},"conditional-count-pattern",[983],{"type":46,"value":984},"Conditional count pattern",{"type":40,"tag":757,"props":986,"children":989},{"className":987,"code":988,"language":46},[760],"# SPL\n| stats count(eval(status>=500)) as errors by host\n\n# APL\n| summarize errors = countif(status >= 500) by host\n",[990],{"type":40,"tag":87,"props":991,"children":992},{"__ignoreMap":765},[993],{"type":46,"value":988},{"type":40,"tag":49,"props":995,"children":996},{},[997,999],{"type":46,"value":998},"Complete function list: ",{"type":40,"tag":87,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":46,"value":1004},"reference\u002Ffunction-mapping.md",{"type":40,"tag":61,"props":1006,"children":1007},{},[],{"type":40,"tag":65,"props":1009,"children":1011},{"id":1010},"eval-extend",[1012],{"type":46,"value":1013},"Eval → Extend",{"type":40,"tag":757,"props":1015,"children":1018},{"className":1016,"code":1017,"language":46},[760],"# SPL\n| eval new_field = old_field * 2\n\n# APL\n| extend new_field = old_field * 2\n",[1019],{"type":40,"tag":87,"props":1020,"children":1021},{"__ignoreMap":765},[1022],{"type":46,"value":1017},{"type":40,"tag":769,"props":1024,"children":1026},{"id":1025},"key-function-mappings-1",[1027],{"type":46,"value":774},{"type":40,"tag":159,"props":1029,"children":1030},{},[1031,1049],{"type":40,"tag":163,"props":1032,"children":1033},{},[1034],{"type":40,"tag":167,"props":1035,"children":1036},{},[1037,1041,1045],{"type":40,"tag":171,"props":1038,"children":1039},{},[1040],{"type":46,"value":175},{"type":40,"tag":171,"props":1042,"children":1043},{},[1044],{"type":46,"value":22},{"type":40,"tag":171,"props":1046,"children":1047},{},[1048],{"type":46,"value":184},{"type":40,"tag":186,"props":1050,"children":1051},{},[1052,1078,1104,1128,1152,1178,1202,1228,1254,1278,1304],{"type":40,"tag":167,"props":1053,"children":1054},{},[1055,1064,1073],{"type":40,"tag":193,"props":1056,"children":1057},{},[1058],{"type":40,"tag":87,"props":1059,"children":1061},{"className":1060},[],[1062],{"type":46,"value":1063},"if(c, t, f)",{"type":40,"tag":193,"props":1065,"children":1066},{},[1067],{"type":40,"tag":87,"props":1068,"children":1070},{"className":1069},[],[1071],{"type":46,"value":1072},"iff(c, t, f)",{"type":40,"tag":193,"props":1074,"children":1075},{},[1076],{"type":46,"value":1077},"Double 'f'",{"type":40,"tag":167,"props":1079,"children":1080},{},[1081,1090,1099],{"type":40,"tag":193,"props":1082,"children":1083},{},[1084],{"type":40,"tag":87,"props":1085,"children":1087},{"className":1086},[],[1088],{"type":46,"value":1089},"case(c1,v1,...)",{"type":40,"tag":193,"props":1091,"children":1092},{},[1093],{"type":40,"tag":87,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":46,"value":1098},"case(c1,v1,...,default)",{"type":40,"tag":193,"props":1100,"children":1101},{},[1102],{"type":46,"value":1103},"Requires default",{"type":40,"tag":167,"props":1105,"children":1106},{},[1107,1116,1125],{"type":40,"tag":193,"props":1108,"children":1109},{},[1110],{"type":40,"tag":87,"props":1111,"children":1113},{"className":1112},[],[1114],{"type":46,"value":1115},"len(str)",{"type":40,"tag":193,"props":1117,"children":1118},{},[1119],{"type":40,"tag":87,"props":1120,"children":1122},{"className":1121},[],[1123],{"type":46,"value":1124},"strlen(str)",{"type":40,"tag":193,"props":1126,"children":1127},{},[],{"type":40,"tag":167,"props":1129,"children":1130},{},[1131,1140,1149],{"type":40,"tag":193,"props":1132,"children":1133},{},[1134],{"type":40,"tag":87,"props":1135,"children":1137},{"className":1136},[],[1138],{"type":46,"value":1139},"lower\u002Fupper",{"type":40,"tag":193,"props":1141,"children":1142},{},[1143],{"type":40,"tag":87,"props":1144,"children":1146},{"className":1145},[],[1147],{"type":46,"value":1148},"tolower\u002Ftoupper",{"type":40,"tag":193,"props":1150,"children":1151},{},[],{"type":40,"tag":167,"props":1153,"children":1154},{},[1155,1164,1173],{"type":40,"tag":193,"props":1156,"children":1157},{},[1158],{"type":40,"tag":87,"props":1159,"children":1161},{"className":1160},[],[1162],{"type":46,"value":1163},"substr",{"type":40,"tag":193,"props":1165,"children":1166},{},[1167],{"type":40,"tag":87,"props":1168,"children":1170},{"className":1169},[],[1171],{"type":46,"value":1172},"substring",{"type":40,"tag":193,"props":1174,"children":1175},{},[1176],{"type":46,"value":1177},"0-indexed in APL",{"type":40,"tag":167,"props":1179,"children":1180},{},[1181,1190,1199],{"type":40,"tag":193,"props":1182,"children":1183},{},[1184],{"type":40,"tag":87,"props":1185,"children":1187},{"className":1186},[],[1188],{"type":46,"value":1189},"replace",{"type":40,"tag":193,"props":1191,"children":1192},{},[1193],{"type":40,"tag":87,"props":1194,"children":1196},{"className":1195},[],[1197],{"type":46,"value":1198},"replace_string",{"type":40,"tag":193,"props":1200,"children":1201},{},[],{"type":40,"tag":167,"props":1203,"children":1204},{},[1205,1214,1223],{"type":40,"tag":193,"props":1206,"children":1207},{},[1208],{"type":40,"tag":87,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":46,"value":1213},"tonumber",{"type":40,"tag":193,"props":1215,"children":1216},{},[1217],{"type":40,"tag":87,"props":1218,"children":1220},{"className":1219},[],[1221],{"type":46,"value":1222},"toint\u002Ftolong\u002Ftoreal",{"type":40,"tag":193,"props":1224,"children":1225},{},[1226],{"type":46,"value":1227},"Explicit types",{"type":40,"tag":167,"props":1229,"children":1230},{},[1231,1240,1249],{"type":40,"tag":193,"props":1232,"children":1233},{},[1234],{"type":40,"tag":87,"props":1235,"children":1237},{"className":1236},[],[1238],{"type":46,"value":1239},"match(s,r)",{"type":40,"tag":193,"props":1241,"children":1242},{},[1243],{"type":40,"tag":87,"props":1244,"children":1246},{"className":1245},[],[1247],{"type":46,"value":1248},"s matches regex \"r\"",{"type":40,"tag":193,"props":1250,"children":1251},{},[1252],{"type":46,"value":1253},"Operator",{"type":40,"tag":167,"props":1255,"children":1256},{},[1257,1266,1274],{"type":40,"tag":193,"props":1258,"children":1259},{},[1260],{"type":40,"tag":87,"props":1261,"children":1263},{"className":1262},[],[1264],{"type":46,"value":1265},"split(s, d)",{"type":40,"tag":193,"props":1267,"children":1268},{},[1269],{"type":40,"tag":87,"props":1270,"children":1272},{"className":1271},[],[1273],{"type":46,"value":1265},{"type":40,"tag":193,"props":1275,"children":1276},{},[1277],{"type":46,"value":266},{"type":40,"tag":167,"props":1279,"children":1280},{},[1281,1290,1299],{"type":40,"tag":193,"props":1282,"children":1283},{},[1284],{"type":40,"tag":87,"props":1285,"children":1287},{"className":1286},[],[1288],{"type":46,"value":1289},"mvjoin(mv, d)",{"type":40,"tag":193,"props":1291,"children":1292},{},[1293],{"type":40,"tag":87,"props":1294,"children":1296},{"className":1295},[],[1297],{"type":46,"value":1298},"strcat_array(arr, d)",{"type":40,"tag":193,"props":1300,"children":1301},{},[1302],{"type":46,"value":1303},"Join array",{"type":40,"tag":167,"props":1305,"children":1306},{},[1307,1316,1325],{"type":40,"tag":193,"props":1308,"children":1309},{},[1310],{"type":40,"tag":87,"props":1311,"children":1313},{"className":1312},[],[1314],{"type":46,"value":1315},"mvcount(mv)",{"type":40,"tag":193,"props":1317,"children":1318},{},[1319],{"type":40,"tag":87,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":46,"value":1324},"array_length(arr)",{"type":40,"tag":193,"props":1326,"children":1327},{},[1328],{"type":46,"value":1329},"Array length",{"type":40,"tag":769,"props":1331,"children":1333},{"id":1332},"case-statement-pattern",[1334],{"type":46,"value":1335},"Case statement pattern",{"type":40,"tag":757,"props":1337,"children":1340},{"className":1338,"code":1339,"language":46},[760],"# SPL\n| eval level = case(\n    status >= 500, \"error\",\n    status >= 400, \"warning\",\n    1==1, \"ok\"\n  )\n\n# APL  \n| extend level = case(\n    status >= 500, \"error\",\n    status >= 400, \"warning\",\n    \"ok\"\n  )\n",[1341],{"type":40,"tag":87,"props":1342,"children":1343},{"__ignoreMap":765},[1344],{"type":46,"value":1339},{"type":40,"tag":49,"props":1346,"children":1347},{},[1348,1350,1356],{"type":46,"value":1349},"Note: SPL's ",{"type":40,"tag":87,"props":1351,"children":1353},{"className":1352},[],[1354],{"type":46,"value":1355},"1==1",{"type":46,"value":1357}," catch-all becomes implicit default in APL.",{"type":40,"tag":61,"props":1359,"children":1360},{},[],{"type":40,"tag":65,"props":1362,"children":1364},{"id":1363},"rex-parseextract",[1365],{"type":46,"value":1366},"Rex → Parse\u002FExtract",{"type":40,"tag":757,"props":1368,"children":1371},{"className":1369,"code":1370,"language":46},[760],"# SPL\n| rex field=message \"user=(?\u003Cusername>\\w+)\"\n\n# APL - parse with regex\n| parse kind=regex message with @\"user=(?P\u003Cusername>\\w+)\"\n\n# APL - extract function  \n| extend username = extract(\"user=(\\\\w+)\", 1, message)\n",[1372],{"type":40,"tag":87,"props":1373,"children":1374},{"__ignoreMap":765},[1375],{"type":46,"value":1370},{"type":40,"tag":769,"props":1377,"children":1379},{"id":1378},"simple-pattern-non-regex",[1380],{"type":46,"value":1381},"Simple pattern (non-regex)",{"type":40,"tag":757,"props":1383,"children":1386},{"className":1384,"code":1385,"language":46},[760],"# SPL\n| rex field=uri \"^\u002Fapi\u002F(?\u003Cversion>v\\d+)\u002F(?\u003Cendpoint>\\w+)\"\n\n# APL\n| parse uri with \"\u002Fapi\u002F\" version \"\u002F\" endpoint\n",[1387],{"type":40,"tag":87,"props":1388,"children":1389},{"__ignoreMap":765},[1390],{"type":46,"value":1385},{"type":40,"tag":61,"props":1392,"children":1393},{},[],{"type":40,"tag":65,"props":1395,"children":1397},{"id":1396},"time-handling",[1398],{"type":46,"value":1399},"Time Handling",{"type":40,"tag":49,"props":1401,"children":1402},{},[1403],{"type":46,"value":1404},"SPL time pickers don't translate. Always add explicit time range:",{"type":40,"tag":757,"props":1406,"children":1409},{"className":1407,"code":1408,"language":46},[760],"# SPL (time picker: Last 24 hours)\nindex=logs\n\n# APL\n['logs'] | where _time between (ago(24h) .. now())\n",[1410],{"type":40,"tag":87,"props":1411,"children":1412},{"__ignoreMap":765},[1413],{"type":46,"value":1408},{"type":40,"tag":769,"props":1415,"children":1417},{"id":1416},"timechart-translation",[1418],{"type":46,"value":1419},"Timechart translation",{"type":40,"tag":757,"props":1421,"children":1424},{"className":1422,"code":1423,"language":46},[760],"# SPL\n| timechart span=5m count by status\n\n# APL\n| summarize count() by bin(_time, 5m), status\n",[1425],{"type":40,"tag":87,"props":1426,"children":1427},{"__ignoreMap":765},[1428],{"type":46,"value":1423},{"type":40,"tag":61,"props":1430,"children":1431},{},[],{"type":40,"tag":65,"props":1433,"children":1435},{"id":1434},"common-patterns",[1436],{"type":46,"value":1437},"Common Patterns",{"type":40,"tag":769,"props":1439,"children":1441},{"id":1440},"error-rate-calculation",[1442],{"type":46,"value":1443},"Error rate calculation",{"type":40,"tag":757,"props":1445,"children":1448},{"className":1446,"code":1447,"language":46},[760],"# SPL\n| stats count(eval(status>=500)) as errors, count as total by host\n| eval error_rate = errors\u002Ftotal*100\n\n# APL\n| summarize errors = countif(status >= 500), total = count() by host\n| extend error_rate = toreal(errors) \u002F total * 100\n",[1449],{"type":40,"tag":87,"props":1450,"children":1451},{"__ignoreMap":765},[1452],{"type":46,"value":1447},{"type":40,"tag":769,"props":1454,"children":1456},{"id":1455},"subquery-subsearch",[1457],{"type":46,"value":1458},"Subquery (subsearch)",{"type":40,"tag":757,"props":1460,"children":1463},{"className":1461,"code":1462,"language":46},[760],"# SPL\nindex=logs [search index=errors | fields user_id | format]\n\n# APL\nlet error_users = ['errors'] | where _time between (ago(1h) .. now()) | distinct user_id;\n['logs']\n| where _time between (ago(1h) .. now())\n| where user_id in (error_users)\n",[1464],{"type":40,"tag":87,"props":1465,"children":1466},{"__ignoreMap":765},[1467],{"type":46,"value":1462},{"type":40,"tag":769,"props":1469,"children":1471},{"id":1470},"join-datasets",[1472],{"type":46,"value":1473},"Join datasets",{"type":40,"tag":757,"props":1475,"children":1478},{"className":1476,"code":1477,"language":46},[760],"# SPL\n| join user_id [search index=users | fields user_id, name]\n\n# APL\n| join kind=inner (['users'] | project user_id, name) on user_id\n",[1479],{"type":40,"tag":87,"props":1480,"children":1481},{"__ignoreMap":765},[1482],{"type":46,"value":1477},{"type":40,"tag":769,"props":1484,"children":1486},{"id":1485},"transaction-like-grouping",[1487],{"type":46,"value":1488},"Transaction-like grouping",{"type":40,"tag":757,"props":1490,"children":1493},{"className":1491,"code":1492,"language":46},[760],"# SPL\n| transaction session_id maxspan=30m\n\n# APL (no direct equivalent — reconstruct with summarize)\n| summarize \n    start_time = min(_time),\n    end_time = max(_time),\n    events = make_list(pack(\"time\", _time, \"action\", action)),\n    duration = max(_time) - min(_time)\n  by session_id\n| where duration \u003C= 30m\n",[1494],{"type":40,"tag":87,"props":1495,"children":1496},{"__ignoreMap":765},[1497],{"type":46,"value":1492},{"type":40,"tag":61,"props":1499,"children":1500},{},[],{"type":40,"tag":65,"props":1502,"children":1504},{"id":1503},"string-matching-performance",[1505],{"type":46,"value":1506},"String Matching Performance",{"type":40,"tag":159,"props":1508,"children":1509},{},[1510,1529],{"type":40,"tag":163,"props":1511,"children":1512},{},[1513],{"type":40,"tag":167,"props":1514,"children":1515},{},[1516,1520,1524],{"type":40,"tag":171,"props":1517,"children":1518},{},[1519],{"type":46,"value":175},{"type":40,"tag":171,"props":1521,"children":1522},{},[1523],{"type":46,"value":22},{"type":40,"tag":171,"props":1525,"children":1526},{},[1527],{"type":46,"value":1528},"Speed",{"type":40,"tag":186,"props":1530,"children":1531},{},[1532,1561,1587,1613],{"type":40,"tag":167,"props":1533,"children":1534},{},[1535,1544,1553],{"type":40,"tag":193,"props":1536,"children":1537},{},[1538],{"type":40,"tag":87,"props":1539,"children":1541},{"className":1540},[],[1542],{"type":46,"value":1543},"field=\"value\"",{"type":40,"tag":193,"props":1545,"children":1546},{},[1547],{"type":40,"tag":87,"props":1548,"children":1550},{"className":1549},[],[1551],{"type":46,"value":1552},"field == \"value\"",{"type":40,"tag":193,"props":1554,"children":1555},{},[1556],{"type":40,"tag":53,"props":1557,"children":1558},{},[1559],{"type":46,"value":1560},"Fastest",{"type":40,"tag":167,"props":1562,"children":1563},{},[1564,1573,1582],{"type":40,"tag":193,"props":1565,"children":1566},{},[1567],{"type":40,"tag":87,"props":1568,"children":1570},{"className":1569},[],[1571],{"type":46,"value":1572},"field=\"*value*\"",{"type":40,"tag":193,"props":1574,"children":1575},{},[1576],{"type":40,"tag":87,"props":1577,"children":1579},{"className":1578},[],[1580],{"type":46,"value":1581},"field contains \"value\"",{"type":40,"tag":193,"props":1583,"children":1584},{},[1585],{"type":46,"value":1586},"Moderate",{"type":40,"tag":167,"props":1588,"children":1589},{},[1590,1599,1608],{"type":40,"tag":193,"props":1591,"children":1592},{},[1593],{"type":40,"tag":87,"props":1594,"children":1596},{"className":1595},[],[1597],{"type":46,"value":1598},"field=\"value*\"",{"type":40,"tag":193,"props":1600,"children":1601},{},[1602],{"type":40,"tag":87,"props":1603,"children":1605},{"className":1604},[],[1606],{"type":46,"value":1607},"field startswith \"value\"",{"type":40,"tag":193,"props":1609,"children":1610},{},[1611],{"type":46,"value":1612},"Fast",{"type":40,"tag":167,"props":1614,"children":1615},{},[1616,1625,1634],{"type":40,"tag":193,"props":1617,"children":1618},{},[1619],{"type":40,"tag":87,"props":1620,"children":1622},{"className":1621},[],[1623],{"type":46,"value":1624},"match(field, regex)",{"type":40,"tag":193,"props":1626,"children":1627},{},[1628],{"type":40,"tag":87,"props":1629,"children":1631},{"className":1630},[],[1632],{"type":46,"value":1633},"field matches regex \"...\"",{"type":40,"tag":193,"props":1635,"children":1636},{},[1637],{"type":40,"tag":53,"props":1638,"children":1639},{},[1640],{"type":46,"value":1641},"Slowest",{"type":40,"tag":49,"props":1643,"children":1644},{},[1645,1647,1653,1655,1661,1663,1669],{"type":46,"value":1646},"Prefer ",{"type":40,"tag":87,"props":1648,"children":1650},{"className":1649},[],[1651],{"type":46,"value":1652},"has",{"type":46,"value":1654}," over ",{"type":40,"tag":87,"props":1656,"children":1658},{"className":1657},[],[1659],{"type":46,"value":1660},"contains",{"type":46,"value":1662}," (word-boundary matching is faster). Use ",{"type":40,"tag":87,"props":1664,"children":1666},{"className":1665},[],[1667],{"type":46,"value":1668},"_cs",{"type":46,"value":1670}," variants for case-sensitive (faster).",{"type":40,"tag":61,"props":1672,"children":1673},{},[],{"type":40,"tag":65,"props":1675,"children":1677},{"id":1676},"reference",[1678],{"type":46,"value":1679},"Reference",{"type":40,"tag":1681,"props":1682,"children":1683},"ul",{},[1684,1694,1704,1715],{"type":40,"tag":76,"props":1685,"children":1686},{},[1687,1692],{"type":40,"tag":87,"props":1688,"children":1690},{"className":1689},[],[1691],{"type":46,"value":746},{"type":46,"value":1693}," — complete command list",{"type":40,"tag":76,"props":1695,"children":1696},{},[1697,1702],{"type":40,"tag":87,"props":1698,"children":1700},{"className":1699},[],[1701],{"type":46,"value":1004},{"type":46,"value":1703}," — complete function list",{"type":40,"tag":76,"props":1705,"children":1706},{},[1707,1713],{"type":40,"tag":87,"props":1708,"children":1710},{"className":1709},[],[1711],{"type":46,"value":1712},"reference\u002Fexamples.md",{"type":46,"value":1714}," — full query translation examples",{"type":40,"tag":76,"props":1716,"children":1717},{},[1718,1720],{"type":46,"value":1719},"APL docs: ",{"type":40,"tag":1721,"props":1722,"children":1726},"a",{"href":1723,"rel":1724},"https:\u002F\u002Faxiom.co\u002Fdocs\u002Fapl\u002Fintroduction",[1725],"nofollow",[1727],{"type":46,"value":1723},{"items":1729,"total":1895},[1730,1742,1757,1767,1785,1804,1820,1833,1846,1864,1874,1881],{"slug":1731,"name":1731,"fn":1732,"description":1733,"org":1734,"tags":1735,"stars":1739,"repoUrl":1740,"updatedAt":1741},"axiom-apl","write and debug APL queries for Axiom","APL query language reference for Axiom. Provides operators, functions, patterns, and CLI usage. Auto-invoked by specialized Axiom skills when writing or debugging APL queries.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1736,1737,1738],{"name":22,"slug":23,"type":16},{"name":9,"slug":8,"type":16},{"name":14,"slug":15,"type":16},58,"https:\u002F\u002Fgithub.com\u002Faxiomhq\u002Fcli","2026-04-06T18:04:15.826882",{"slug":1743,"name":1743,"fn":1744,"description":1745,"org":1746,"tags":1747,"stars":1739,"repoUrl":1740,"updatedAt":1756},"detect-anomalies","detect anomalies in observability data","Detect anomalies in Axiom datasets using statistical analysis. Use when looking for unusual patterns, volume spikes, outliers, or new error types in observability data.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1748,1749,1752,1755],{"name":9,"slug":8,"type":16},{"name":1750,"slug":1751,"type":16},"Data Analysis","data-analysis",{"name":1753,"slug":1754,"type":16},"Monitoring","monitoring",{"name":14,"slug":15,"type":16},"2026-04-06T18:04:19.681304",{"slug":1758,"name":1758,"fn":1759,"description":1760,"org":1761,"tags":1762,"stars":1739,"repoUrl":1740,"updatedAt":1766},"explore-dataset","explore Axiom dataset schema and patterns","Explore an Axiom dataset to understand its schema, fields, volume, and patterns. Use when discovering a new dataset, investigating data structure, or understanding what data is available.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1763,1764,1765],{"name":9,"slug":8,"type":16},{"name":1750,"slug":1751,"type":16},{"name":14,"slug":15,"type":16},"2026-04-06T18:04:18.425533",{"slug":1768,"name":1768,"fn":1769,"description":1770,"org":1771,"tags":1772,"stars":1739,"repoUrl":1740,"updatedAt":1784},"find-traces","analyze OpenTelemetry distributed traces in Axiom","Analyze OpenTelemetry distributed traces from Axiom. Use when investigating a trace ID, finding traces by criteria (errors, latency, service), or debugging distributed system issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1773,1774,1777,1780,1781],{"name":9,"slug":8,"type":16},{"name":1775,"slug":1776,"type":16},"Debugging","debugging",{"name":1778,"slug":1779,"type":16},"Distributed Tracing","distributed-tracing",{"name":14,"slug":15,"type":16},{"name":1782,"slug":1783,"type":16},"OpenTelemetry","opentelemetry","2026-04-06T18:04:17.130694",{"slug":1786,"name":1786,"fn":1787,"description":1788,"org":1789,"tags":1790,"stars":24,"repoUrl":25,"updatedAt":1803},"axiom-alerting","manage Axiom monitors and notifiers","Create and manage Axiom monitors and notifiers via the v2 public API. Use when building alerting, routing notifications, validating monitor behavior, and maintaining alert configurations end-to-end.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1791,1794,1795,1798,1799,1800],{"name":1792,"slug":1793,"type":16},"API Development","api-development",{"name":9,"slug":8,"type":16},{"name":1796,"slug":1797,"type":16},"Messaging","messaging",{"name":1753,"slug":1754,"type":16},{"name":14,"slug":15,"type":16},{"name":1801,"slug":1802,"type":16},"Operations","operations","2026-05-11T06:13:11.543806",{"slug":1805,"name":1805,"fn":1806,"description":1807,"org":1808,"tags":1809,"stars":24,"repoUrl":25,"updatedAt":1819},"axiom-sre","investigate incidents with Axiom","Expert SRE investigator for incidents and debugging. Uses hypothesis-driven methodology and systematic triage. Can query Axiom observability when available. Use for incident response, root cause analysis, production debugging, or log investigation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1810,1811,1812,1815,1816],{"name":9,"slug":8,"type":16},{"name":1775,"slug":1776,"type":16},{"name":1813,"slug":1814,"type":16},"Incident Response","incident-response",{"name":14,"slug":15,"type":16},{"name":1817,"slug":1818,"type":16},"SRE","sre","2026-04-06T18:04:27.289824",{"slug":1821,"name":1821,"fn":1822,"description":1823,"org":1824,"tags":1825,"stars":24,"repoUrl":25,"updatedAt":1832},"building-dashboards","build Axiom dashboards via API","Designs and builds Axiom dashboards via API. Covers chart types, APL and metrics\u002FMPL query patterns, SmartFilters, layout, and configuration options. Use when creating dashboards, migrating from Splunk, or configuring chart options.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1826,1827,1828,1831],{"name":22,"slug":23,"type":16},{"name":9,"slug":8,"type":16},{"name":1829,"slug":1830,"type":16},"Dashboards","dashboards",{"name":14,"slug":15,"type":16},"2026-04-06T18:04:23.452912",{"slug":1834,"name":1834,"fn":1835,"description":1836,"org":1837,"tags":1838,"stars":24,"repoUrl":25,"updatedAt":1845},"controlling-costs","reduce Axiom query costs","Analyzes Axiom query patterns to find unused data, then builds dashboards and monitors for cost optimization. Use when asked to reduce Axiom costs, find unused columns or field values, identify data waste, or track ingest spend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1839,1840,1843,1844],{"name":9,"slug":8,"type":16},{"name":1841,"slug":1842,"type":16},"Cost Optimization","cost-optimization",{"name":1829,"slug":1830,"type":16},{"name":14,"slug":15,"type":16},"2026-04-06T18:04:22.202025",{"slug":1847,"name":1847,"fn":1848,"description":1849,"org":1850,"tags":1851,"stars":24,"repoUrl":25,"updatedAt":1863},"metrics-chart","render Axiom metrics as charts","Render Axiom metrics query results (application\u002Fvnd.metrics.v3+json) as line charts. Zero-dependency Unicode\u002FASCII by default; upgrades to inline PNG\u002FSVG\u002Fsixel via gnuplot when present. Use when you have a metrics v3 query response and want to see the series as a chart in the terminal or transcript.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1852,1853,1856,1859,1862],{"name":9,"slug":8,"type":16},{"name":1854,"slug":1855,"type":16},"Charts","charts",{"name":1857,"slug":1858,"type":16},"Data Visualization","data-visualization",{"name":1860,"slug":1861,"type":16},"Metrics","metrics",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:14.576127",{"slug":1865,"name":1865,"fn":1866,"description":1867,"org":1868,"tags":1869,"stars":24,"repoUrl":25,"updatedAt":1873},"query-metrics","query Axiom MetricsDB","Runs metrics queries against Axiom MetricsDB via scripts. Discovers available metrics, tags, and tag values. Use when asked to query metrics, explore metric datasets, check metric values, or investigate OTel metrics data.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1870,1871,1872],{"name":9,"slug":8,"type":16},{"name":1860,"slug":1861,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:12:32.381376",{"slug":4,"name":4,"fn":5,"description":6,"org":1875,"tags":1876,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1877,1878,1879,1880],{"name":22,"slug":23,"type":16},{"name":9,"slug":8,"type":16},{"name":19,"slug":20,"type":16},{"name":14,"slug":15,"type":16},{"slug":1882,"name":1882,"fn":1883,"description":1884,"org":1885,"tags":1886,"stars":24,"repoUrl":25,"updatedAt":1894},"writing-evals","scaffold evals for the Axiom AI SDK","Scaffolds evaluation suites for the Axiom AI SDK. Generates eval files, scorers, flag schemas, and config from natural-language descriptions. Use when creating evals, writing scorers, setting up flag schemas, or configuring axiom.config.ts.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1887,1890,1891],{"name":1888,"slug":1889,"type":16},"AI Infrastructure","ai-infrastructure",{"name":9,"slug":8,"type":16},{"name":1892,"slug":1893,"type":16},"Evals","evals","2026-04-06T18:04:26.007097",12,{"items":1897,"total":1950},[1898,1907,1915,1922,1929,1937,1943],{"slug":1786,"name":1786,"fn":1787,"description":1788,"org":1899,"tags":1900,"stars":24,"repoUrl":25,"updatedAt":1803},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1901,1902,1903,1904,1905,1906],{"name":1792,"slug":1793,"type":16},{"name":9,"slug":8,"type":16},{"name":1796,"slug":1797,"type":16},{"name":1753,"slug":1754,"type":16},{"name":14,"slug":15,"type":16},{"name":1801,"slug":1802,"type":16},{"slug":1805,"name":1805,"fn":1806,"description":1807,"org":1908,"tags":1909,"stars":24,"repoUrl":25,"updatedAt":1819},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1910,1911,1912,1913,1914],{"name":9,"slug":8,"type":16},{"name":1775,"slug":1776,"type":16},{"name":1813,"slug":1814,"type":16},{"name":14,"slug":15,"type":16},{"name":1817,"slug":1818,"type":16},{"slug":1821,"name":1821,"fn":1822,"description":1823,"org":1916,"tags":1917,"stars":24,"repoUrl":25,"updatedAt":1832},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1918,1919,1920,1921],{"name":22,"slug":23,"type":16},{"name":9,"slug":8,"type":16},{"name":1829,"slug":1830,"type":16},{"name":14,"slug":15,"type":16},{"slug":1834,"name":1834,"fn":1835,"description":1836,"org":1923,"tags":1924,"stars":24,"repoUrl":25,"updatedAt":1845},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1925,1926,1927,1928],{"name":9,"slug":8,"type":16},{"name":1841,"slug":1842,"type":16},{"name":1829,"slug":1830,"type":16},{"name":14,"slug":15,"type":16},{"slug":1847,"name":1847,"fn":1848,"description":1849,"org":1930,"tags":1931,"stars":24,"repoUrl":25,"updatedAt":1863},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1932,1933,1934,1935,1936],{"name":9,"slug":8,"type":16},{"name":1854,"slug":1855,"type":16},{"name":1857,"slug":1858,"type":16},{"name":1860,"slug":1861,"type":16},{"name":14,"slug":15,"type":16},{"slug":1865,"name":1865,"fn":1866,"description":1867,"org":1938,"tags":1939,"stars":24,"repoUrl":25,"updatedAt":1873},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1940,1941,1942],{"name":9,"slug":8,"type":16},{"name":1860,"slug":1861,"type":16},{"name":14,"slug":15,"type":16},{"slug":4,"name":4,"fn":5,"description":6,"org":1944,"tags":1945,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1946,1947,1948,1949],{"name":22,"slug":23,"type":16},{"name":9,"slug":8,"type":16},{"name":19,"slug":20,"type":16},{"name":14,"slug":15,"type":16},8]