From Splunk

Embed
Preview of the card
<a href="https://forumulate.com/p/watchtower/docs/splunk"><img src="https://forumulate.com/api/public/orgs/watchtower/spaces/docs/pages/58f60851-bddc-4245-9354-df425f1a5fb4/social-card.svg?v=3e7ae33eec8b" alt="From Splunk" width="600" height="315"></a>

Searches are translated, not imported:

curl -X POST $WT_API/v1/translate/log-query -H "Authorization: Bearer $WT_API_KEY" \
  -d '{"dialect":"spl","query":"error status=500 | stats count by host | sort -count | head 10"}'

The answer is {query, warnings, unsupported, partial}; query is logs | where error and status: 500 | stats count() by host | sort -count | limit 10.

Supported: search terms with AND/OR/NOT and key=value, fields/table, stats (count, sum, avg, min, max, dc, p95) with by and as, where with comparisons, eval with arithmetic only, timechart span=... <agg> by, simple rex, head, sort.

index= and sourcetype= are ignored with a warning (a project is one data source). Other commands (lookup, join, transaction, eval functions, ...) are listed under unsupported; partial is then true. Dialects datadog, kql and lucene use the same route.

Updated