Splunk SPL ↔ Microsoft KQL

Intent	Splunk SPL	Microsoft KQL
Source	index=security	SecurityEvent
Filter	EventCode=4625 user=*	where EventID == 4625 and isnotempty(Account)
Select	table _time user src	project TimeGenerated, Account, IpAddress
Rename	rename src AS IpAddress	project-rename IpAddress=SourceIP
Count/group	stats count by user	summarize count() by Account
Distinct count	dc(user)	dcount(Account)
Time bucket	bin _time span=5m	bin(TimeGenerated, 5m)
Sort	sort - count	sort by count_ desc
Top values	top limit=10 user	summarize count() by Account | top 10 by count_
Join/lookup	lookup, join	lookup, join
Parse JSON	spath	parse_json() / extend

SPL: failed logons by user and source

index=security EventCode=4625
| stats count min(_time) AS first_seen max(_time) AS last_seen BY user src
| sort - count

KQL: failed logons by user and source

SecurityEvent
| where EventID == 4625
| summarize Attempts=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Account, IpAddress
| sort by Attempts desc

Translation checklist

1. Identify equivalent dataset/index/table.
2. Map normalized versus vendor fields.
3. Match time range and event semantics.
4. Rebuild aggregation and null handling.
5. Validate against known events before operational use.