> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md). # Translate to XQL To help you easily convert your existing Splunk queries to the Cortex Query Language (XQL) syntax, Cortex XSIAM includes a toggle called **Translate to XQL** in the query field in the user interface. When building your XQL query and this option is selected, both a **SPL query** field and **XQL query** field are displayed, so you can easily add a Splunk query, which is converted to XQL in the XQL query field. This option is disabled by default, so only the **XQL query** field is displayed. {% hint style="info" %} ### Important This feature is still in a Beta state and you will find that not all Splunk queries can be converted to XQL. This feature will be improved upon in the upcoming releases to support greater Splunk query translations to XQL. {% endhint %}
Supported functions in Splunk The following table details the supported functions in Splunk that can be converted to XQL in Cortex XSIAM with an example of a Splunk query and the resulting XQL query. In each of these examples, the `xdr_data` dataset is used. | Splunk Function/Stage | Splunk Query Example | Resulting XQL Query Example | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------- | | `avg` | \`index=xdr\_data | stats avg(dst\_association\_strength)\` | | `bin` | \`index = xdr\_data | bin \_time span=5m\` | | `coalesce` | \`index= xdr\_data | eval product\_or\_vendor\_not\_null=coalesce(\_product, \_vendor )\` | | `count` | \`index=xdr\_data | stats count(\_product) BY \_time\` | | `ctime` | \`index=xdr\_data | convert ctime(field) as field\` | | `earliest` | `index = xdr_data earliest=24d` | \`dataset in (xdr\_data) | | `eval` | \`index=xdr\_data | eval field = "test"\` | | `fillnull` | \`index=xdr\_data | fillnull value = "missing ipv6" agent\_ip\_addresses\_v6\` | | `floor` | \`index=xdr\_data | eval floor\_test = floor(1.9)\` | | `iplocation` | \`index=xdr\_data | inputlookup append=true my\_lookup.csv\` | | `iplocation` | \`index = xdr\_data | inputlookup agent\_ip\_addresses\` | | `isnotnull` | \`index=xdr\_data | eval x = isnotnull(agent\_hostname)\` | | `isnull` | \`index=xdr\_data | eval x = isnull(agent\_hostname)\` | | `json_extract` | \`index= xdr\_data | eval London=json\_extract(dfe\_labels,"dfe\_labels{0}")\` | | `join` | `join agent_hostname [index = xdr_data]` | `join type=left conflict_strategy=right (dataset in (xdr_data)) as inner agent_hostname = inner.agent_hostname` | | `latest` | `index = xdr_data latest=-24d` | \`dataset in (xdr\_data) | | `len` | \`index = xdr\_data | where uri != null | | `ltrim(,)` | \`index=xdr\_data | eval trimed\_agent=ltrim("agent\_hostname", "agent\_")\` | | `lower` | \`index = xdr\_data | eval field = lower("TEST")\` | | `max` | \`index =xdr\_data | stats max(action\_file\_size) by \_product\` | | `md5` | \`index=xdr\_data | eval md5\_test = md5("test")\` | | `median` | \`index = xdr\_data | stats median(actor\_process\_file\_size) by \_time\` | | `min` | \`index =xdr\_data | stats min(action\_file\_size) by \_product\` | | `mvcount` | \`index = xdr\_data | where http\_data != null | | `mvdedup` | \`index = xdr\_data | eval s=mvdedup(action\_app\_id\_transitions)\` | | `mvexpand` | \`index = xdr\_data | mvexpand dfe\_labels limit = 100\` | | `mvfilter` | \`index = xdr\_data | eval x = mvfilter(isnull(dfe\_labels))\` | | `mvindex` | \`index=xdr\_data | eval field = mvindex(action\_app\_id\_transitions, 0)\` | | `mvjoin` | \`index=xdr\_data | eval n=mvjoin(action\_app\_id\_transitions, ";")\` | | `pow` | \`index=xdr\_data | eval pow\_test = pow(2, 3)\` | | `relative_time(X,Y)` |
  • \`index ="xdr\_data"
| where \_time > relative\_time(now(),"-7d\@d")`
  • `index ="xdr\_data" | | `replace` | \`index= xdr\_data | eval description = replace(agent\_hostname,"("."NEW")\` | | `rex` | \`index=xdr\_data action\_local\_ip!="0.0.0.0" | rex field=action\_local\_ip "(?\\d+.\d+.\d+.48)" | | `round` | \`index=xdr\_data | eval round\_num = round(3.5)\` | | `rtrim` | \`index=xdr\_data | eval trimed\_hostname=rtrim("agent\_hostname", "hostname")\` | | `search` | \`index = xdr\_data | eval ip="192.0.2.56" | | `sha256` | \`index = xdr\_data | eval sha256\_test = sha256("test")\` | | `sort (ascending order)` | \`index = xdr\_data | sort action\_file\_size\` | | `sort (descending order)` | \`index = xdr\_data | sort -action\_file\_size\` | | `spath` | \`index = xdr\_data | spath output=myfield input=action\_network\_http path=headers.User-Agent\` | | `split` | \`index = xdr\_data | where mac != null | | `stats` | \`index=xdr\_data | stats count(event\_type) by \_time\` | | `stats dc` | \`index = xdr\_data | stats dc(\_product) BY \_time\` | | `strcat` | \`index=xdr\_data | strcat story\_id "/" http\_req\_before\_method comboIP\` | | `sum` | \`index=xdr\_data | where action\_file\_size != null | | `table` | \`index = xdr\_data | table \_time, agent\_hostname, agent\_ip\_addresses, \_product\` | | `tonumber` | \`index=xdr\_data | eval tonumber\_test = tonumber("90210")\` | | `top` |

    The following Splunk functions can be translated to XQL:

    • limit

      \`index = xdr\_data

    | where action\_app\_id\_risk > 0 | | `upper` | \`index=xdr\_data | eval field = upper("test")\` | | `var` | \`index=xdr\_data | stats var (event\_type) by \_time\` |
    • How to translate a Splunk query to XQL syntax 1. Select **Investigation & Response** → **Search** → **Query Builder** → **XQL**. 2. Toggle to **Translate to XQL**, where both a **SPL query** field and **XQL query** field are displayed. 3. Add your Splunk query to the **SPL query** field. 4. Click the arrow (![translate-to-spl-arrow.png](/files/XSzUL5YRK8yWcLLfd0Oi)). The **XQL query** field displays the equivalent Splunk query using the XQL syntax. You can now decide what to do with this query based on the instructions explained in [Create XQL query](/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md).
    --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.