How to use the SPL to APL Translator agent skill

What the spl-to-apl skill makes the agent do

Once installed, the agent knows the command, function and syntax mappings between SPL and APL. When you give it a Splunk search, it uses those mappings to produce an APL query and points out where the two languages behave differently.

The skill is reference-driven. It is a translator, not a connection to either system: it does not query Splunk or Axiom on your behalf, and it does not run your converted query for you.

• Maps SPL commands such as stats, eval, rex and timechart to APL operators such as summarize, extend, parse and bin.
• Maps common functions, for example dc to dcount, median to percentile(field, 50), and if to iff.
• Flags differences you need to handle, such as explicit time ranges, reversed cidrmatch arguments and casting string fields before numeric comparisons.
• Notes SPL constructs with no direct equivalent, such as transaction, and suggests a summarize-based rebuild.

How to install the spl-to-apl skill

You can install the skill in one of two ways. Download the ZIP of the spl-to-apl skill from this page and unzip it into one of these folders, depending on whether you want it for all projects or one project:

Option A, for your user account: unzip into ~/.claude/skills/ so the skill folder sits there. Option B, for one project: unzip into the .claude/skills/ folder inside that project.

Option C, in the Claude apps: open Settings, go to Capabilities, then Skills, and upload the skill from the ZIP.

• Make sure the unzipped folder contains SKILL.md at its top level, since that file defines the skill.
• Restart or start a new session in your agent if it was already running, so it picks up the new skill.

How to trigger the skill with natural requests

You do not need a special command. The skill's description says to use it when migrating from Splunk, converting SPL queries, or learning APL equivalents of SPL patterns, so ask for those things in plain language.

Paste the full SPL search and say what you want. Mention the Axiom dataset name if you know it, because the skill writes queries against a dataset in place of a Splunk index.

• Convert this Splunk search to Axiom APL: index=logs | stats count by status
• Migrate this SPL alert to APL and tell me what needs manual review.
• What is the APL equivalent of SPL's rex with a named capture group?
• Show me APL equivalents for these three SPL pipelines so I can learn the patterns.

Examples of SPL to APL translation

The source shows side-by-side patterns the agent draws from. A basic stats search becomes a summarize, and the index becomes a dataset in square brackets.

A conditional count inside stats becomes countif in APL. Note that a Splunk time picker does not carry over, so the APL needs an explicit time filter.

• SPL search index=logs with a time picker of last 24 hours becomes ['logs'] | where _time between (ago(24h) .. now()).
• SPL timechart span=5m count by status becomes summarize count() by bin(_time, 5m), status.
• SPL stats count(eval(status>=500)) as errors by host becomes summarize errors = countif(status >= 500) by host.

What the skill needs, safety notes and tips

The skill itself needs no account and does not use the network or run scripts. You need an Axiom account or Playground access only if you want to run the queries the agent produces.

Treat the output as a draft. The bundled tests were checked against sample data, but some SPL constructs have no direct equivalent and need manual rework, and translations of string fields need checking against your real data types.

• Runs scripts: no. Uses network: no.
• Cast string fields before numeric comparison. Write toint(status) >= 500 rather than status >= 500, because status is often stored as a string.
• Join in APL is a preview feature, limited to 50k rows, and supports inner, innerunique and leftouter only.
• The cidrmatch arguments are reversed: SPL cidrmatch(cidr, ip) becomes APL ipv4_is_in_range(ip, cidr).
• For string matching, field == value is fastest, contains is moderate, and match or regex is slowest. Prefer has over contains where word matching is enough.

Where to find the full mappings

The skill folder includes reference files with complete lists. Ask the agent to check them when your search uses a command or function that is not in the summary table.

The skill's main file links to the APL documentation at https://axiom.co/docs/apl/introduction for details on any operator.

• reference/command-mapping.md lists the complete command mappings.
• reference/function-mapping.md lists the complete function mappings.
• reference/examples.md has full query translation examples.
• tests/test-queries.md holds the bundled test queries.