Translate to XQL ↗

To help you easily convert your existing Splunk queries to the Cortex Query Language (XQL) syntax, Cortex XSIAM includes a toggle called Translate to XQL in the query field in the user interface. When building your XQL query and this option is selected, both a SPL query field and XQL query field are displayed, so you can easily add a Splunk query, which is converted to XQL in the XQL query field. This option is disabled by default, so only the XQL query field is displayed.

Important

This feature is still in a Beta state and you will find that not all Splunk queries can be converted to XQL. This feature will be improved upon in the upcoming releases to support greater Splunk query translations to XQL.

Supported functions in Splunk

The following table details the supported functions in Splunk that can be converted to XQL in Cortex XSIAM with an example of a Splunk query and the resulting XQL query. In each of these examples, the xdr_data dataset is used.

| Splunk Function/Stage | Splunk Query Example | Resulting XQL Query Example |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| avg | `index=xdr_data | stats avg(dst_association_strength)` |
| bin | `index = xdr_data | bin _time span=5m` |
| coalesce | `index= xdr_data | eval product_or_vendor_not_null=coalesce(_product, _vendor )` |
| count | `index=xdr_data | stats count(_product) BY _time` |
| ctime | `index=xdr_data | convert ctime(field) as field` |
| earliest | index = xdr_data earliest=24d | `dataset in (xdr_data) |
| eval | `index=xdr_data | eval field = "test"` |
| fillnull | `index=xdr_data | fillnull value = "missing ipv6" agent_ip_addresses_v6` |
| floor | `index=xdr_data | eval floor_test = floor(1.9)` |
| iplocation | `index=xdr_data | inputlookup append=true my_lookup.csv` |
| iplocation | `index = xdr_data | inputlookup agent_ip_addresses` |
| isnotnull | `index=xdr_data | eval x = isnotnull(agent_hostname)` |
| isnull | `index=xdr_data | eval x = isnull(agent_hostname)` |
| json_extract | `index= xdr_data | eval London=json_extract(dfe_labels,"dfe_labels{0}")` |
| join | join agent_hostname [index = xdr_data] | join type=left conflict_strategy=right (dataset in (xdr_data)) as inner agent_hostname = inner.agent_hostname |
| latest | index = xdr_data latest=-24d | `dataset in (xdr_data) |
| len | `index = xdr_data | where uri != null |
| ltrim(<str>,<trim_chars>) | `index=xdr_data | eval trimed_agent=ltrim("agent_hostname", "agent_")` |
| lower | `index = xdr_data | eval field = lower("TEST")` |
| max | `index =xdr_data | stats max(action_file_size) by _product` |
| md5 | `index=xdr_data | eval md5_test = md5("test")` |
| median | `index = xdr_data | stats median(actor_process_file_size) by _time` |
| min | `index =xdr_data | stats min(action_file_size) by _product` |
| mvcount | `index = xdr_data | where http_data != null |
| mvdedup | `index = xdr_data | eval s=mvdedup(action_app_id_transitions)` |
| mvexpand | `index = xdr_data | mvexpand dfe_labels limit = 100` |
| mvfilter | `index = xdr_data | eval x = mvfilter(isnull(dfe_labels))` |
| mvindex | `index=xdr_data | eval field = mvindex(action_app_id_transitions, 0)` |
| mvjoin | `index=xdr_data | eval n=mvjoin(action_app_id_transitions, ";")` |
| pow | `index=xdr_data | eval pow_test = pow(2, 3)` |
| relative_time(X,Y) | <ul><li>index ="xdr_data"</li></ul> | where \_time > relative\_time(now(),"-7d@d")</li><li>index ="xdr\_data" | | replace | \index= xdr_data | eval description = replace(agent_hostname,"("."NEW")` |
| rex | `index=xdr_data action_local_ip!="0.0.0.0" | rex field=action_local_ip "(?<src_ip>\d+.\d+.\d+.48)" |
| round | `index=xdr_data | eval round_num = round(3.5)` |
| rtrim | `index=xdr_data | eval trimed_hostname=rtrim("agent_hostname", "hostname")` |
| search | `index = xdr_data | eval ip="192.0.2.56" |
| sha256 | `index = xdr_data | eval sha256_test = sha256("test")` |
| sort (ascending order) | `index = xdr_data | sort action_file_size` |
| sort (descending order) | `index = xdr_data | sort -action_file_size` |
| spath | `index = xdr_data | spath output=myfield input=action_network_http path=headers.User-Agent` |
| split | `index = xdr_data | where mac != null |
| stats | `index=xdr_data | stats count(event_type) by _time` |
| stats dc | `index = xdr_data | stats dc(_product) BY _time` |
| strcat | `index=xdr_data | strcat story_id "/" http_req_before_method comboIP` |
| sum | `index=xdr_data | where action_file_size != null |
| table | `index = xdr_data | table _time, agent_hostname, agent_ip_addresses, _product` |
| tonumber | `index=xdr_data | eval tonumber_test = tonumber("90210")` |
| top | <p>The following Splunk functions can be translated to XQL:</p><ul><li><p>limit</p><p>index = xdr_data</p></li></ul> | where action\_app\_id\_risk > 0 | | upper | \index=xdr_data | eval field = upper("test")` |
| var | `index=xdr_data | stats var (event_type) by _time` |

How to translate a Splunk query to XQL syntax

  1. Select Investigation & Response → Search → Query Builder → XQL.
  2. Toggle to Translate to XQL, where both a SPL query field and XQL query field are displayed.
  3. Add your Splunk query to the SPL query field.

  4. Click the arrow (translate-to-spl-arrow.png).

    The XQL query field displays the equivalent Splunk query using the XQL syntax.

    You can now decide what to do with this query based on the instructions explained in Create XQL query.