Translate to XQL

Learn how to translate your Splunk queries to XQL queries in Cortex XDR.

Notice

Building Cortex Query Language (XQL) queries in the Query Builder requires a Cortex XDR Pro license.

To help you easily convert your existing Splunk queries to the Cortex Query Language (XQL) syntax, Cortex XDR includes a toggle called Translate to XQL in the query field in the user interface. When building your XQL query and this option is selected, both a SPL query field and XQL query field are displayed, so you can easily add a Splunk query, which is converted to XQL in the XQL query field. This option is disabled by default, so only the XQL query field is displayed.

Important

This feature is still in a Beta state and you will find that not all Splunk queries can be converted to XQL. This feature will be improved upon in the upcoming releases to support greater Splunk query translations to XQL.

Supported functions in Splunk

The following table details the supported functions in Splunk that can be converted to XQL in Cortex XDR with an example of a Splunk query and the resulting XQL query. In each of these examples, the xdr_data dataset is used.

Splunk Function/Stage	Splunk Query Example	Resulting XQL Query Example
avg	`index=xdr_data	stats avg(dst_association_strength)`
bin	`index = xdr_data	bin _time span=5m`
coalesce	`index= xdr_data	eval product_or_vendor_not_null=coalesce(_product, _vendor )`
count	`index=xdr_data	stats count(_product) BY _time`
ctime	`index=xdr_data	convert ctime(field) as field`
earliest	index = xdr_data earliest=24d	`dataset in (xdr_data)
eval	`index=xdr_data	eval field = "test"`
fillnull	`index=xdr_data	fillnull value = "missing ipv6" agent_ip_addresses_v6`
floor	`index=xdr_data	eval floor_test = floor(1.9)`
iplocation	`index=xdr_data	inputlookup append=true my_lookup.csv`
iplocation	`index = xdr_data	inputlookup agent_ip_addresses`
isnotnull	`index=xdr_data	eval x = isnotnull(agent_hostname)`
isnull	`index=xdr_data	eval x = isnull(agent_hostname)`
json_extract	`index= xdr_data	eval London=json_extract(dfe_labels,"dfe_labels{0}")`
join	join agent_hostname [index = xdr_data]	join type=left conflict_strategy=right (dataset in (xdr_data)) as inner agent_hostname = inner.agent_hostname
latest	index = xdr_data latest=-24d	`dataset in (xdr_data)
len	`index = xdr_data	where uri != null
ltrim(<str>,<trim_chars>)	`index=xdr_data	eval trimed_agent=ltrim("agent_hostname", "agent_")`
lower	`index = xdr_data	eval field = lower("TEST")`
max	`index =xdr_data	stats max(action_file_size) by _product`
md5	`index=xdr_data	eval md5_test = md5("test")`
median	`index = xdr_data	stats median(actor_process_file_size) by _time`
min	`index =xdr_data	stats min(action_file_size) by _product`
mvcount	`index = xdr_data	where http_data != null
mvdedup	`index = xdr_data	eval s=mvdedup(action_app_id_transitions)`
mvexpand	`index = xdr_data	mvexpand dfe_labels limit = 100`
mvfilter	`index = xdr_data	eval x = mvfilter(isnull(dfe_labels))`
mvindex	`index=xdr_data	eval field = mvindex(action_app_id_transitions, 0)`
mvjoin	`index=xdr_data	eval n=mvjoin(action_app_id_transitions, ";")`
pow	`index=xdr_data	eval pow_test = pow(2, 3)`
relative_time(X,Y)	`index ="xdr_data"	where _time > relative_time(now(),"-7d@d")</li><li>index ="xdr_data"
replace	`index= xdr_data	eval description = replace(agent_hostname,"("."NEW")`
rex	`index=xdr_data action_local_ip!="0.0.0.0"	rex field=action_local_ip "(?<src_ip>\d+.\d+.\d+.48)"
round	`index=xdr_data	eval round_num = round(3.5)`
rtrim	`index=xdr_data	eval trimed_hostname=rtrim("agent_hostname", "hostname")`
search	`index = xdr_data	eval ip="192.0.2.56"
sha256	`index = xdr_data	eval sha256_test = sha256("test")`
sort (ascending order)	`index = xdr_data	sort action_file_size`
sort (descending order)	`index = xdr_data	sort -action_file_size`
spath	`index = xdr_data	spath output=myfield input=action_network_http path=headers.User-Agent`
split	`index = xdr_data	where mac != null
stats	`index=xdr_data	stats count(event_type) by _time`
stats dc	`index = xdr_data	stats dc(_product) BY _time`
strcat	`index=xdr_data	strcat story_id "/" http_req_before_method comboIP`
sum	`index=xdr_data	where action_file_size != null
table	`index = xdr_data	table _time, agent_hostname, agent_ip_addresses, _product`
tonumber	`index=xdr_data	eval tonumber_test = tonumber("90210")`
top	The following Splunk functions can be translated to XQL: limit `index = xdr_data	where action_app_id_risk > 0
upper	`index=xdr_data	eval field = upper("test")`
var	`index=xdr_data	stats var (event_type) by _time`

How to translate a Splunk query to XQL syntax

1. Select Incident Response → Investigation → Query Builder → XQL Search.
2. Toggle to Translate to XQL, where both a SPL query field and XQL query field are displayed.
3. Add your Splunk query to the SPL query field.
4. Click the arrow ().

   The XQL query field displays the equivalent Splunk query using the XQL syntax.

   You can now decide what to do with this query based on the instructions explained in Create XQL query.