Query languages¶
| Need | Open |
|---|---|
| Translate concepts and syntax between SIEMs | Splunk SPL to Microsoft KQL |
Field names and schemas vary. Validate the time range, index or table, parser, and normalized fields before using a translated query.
| Need | Open |
|---|---|
| Translate concepts and syntax between SIEMs | Splunk SPL to Microsoft KQL |
Field names and schemas vary. Validate the time range, index or table, parser, and normalized fields before using a translated query.