SplConverter 0.1.0-alpha.1

SplConverter

A lightweight .NET library for converting Splunk SPL queries into:

• Elasticsearch Query DSL
• Elasticsearch ES|QL

Author

Farshid Sar

NuGet.org: https://www.nuget.org/profiles/farshidsar

Status

Preview release.

This package currently supports a practical subset of SPL and is under active development.

Features

Supported Commands

Search / Where

status=500
host="web01"
status=500 AND host="web01"
NOT status=200

Time Range

earliest=-24h latest=now

Statistics

| stats count
| stats count by host
| stats avg(duration) by service

Timechart

| timechart count

Eval

| eval severity="error"

Rex

| rex field=message "(?<user>\w+)"

Sort

| sort -timestamp

Head / Tail

| head 10
| tail 10

Top / Rare

| top host
| rare host

Dedup

| dedup host

Table / Fields

| table host status
| fields host status

Rename

| rename host as hostname

Installation

Local Package

dotnet add package SplConverter

Local Feed

Create a local feed folder and pack:

dotnet pack -c Debug -o ./artifacts

Then add the folder as a NuGet source.

Quick Start

using Spl.Core;
using Spl.Core.Options;

var converter = new SplConverter();

var result = converter.ToElasticDsl(
    "status=500 | stats count by host",
    new SplConverterOptions
    {
        IndexName = "logs-*",
        TimeField = "@timestamp"
    });

Console.WriteLine(result.Output);

ES|QL Example

Input:

status=500 | stats count by host

Output:

FROM logs-*
| WHERE status == 500
| STATS count(*) BY host

Elasticsearch DSL Example

Input:

status=500 | stats count by host

Output:

{
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "status": 500
          }
        }
      ]
    }
  }
}

Configuration

var options = new SplConverterOptions
{
    IndexName = "logs-*",
    TimeField = "@timestamp",
    KeywordSuffix = ".keyword",
    IndentJson = true
};

CLI Usage

spl-converter --spl "status=500 | stats count by host" --target dsl

spl-converter --spl "status=500 | stats count by host" --target esql

spl-converter --input query.spl --target dsl

cat query.spl | spl-converter --target esql

Building

dotnet restore
dotnet build

Create package:

dotnet pack Spl.Core/Spl.Core.csproj -c Debug -o ./artifacts

Debugging From Another Project

During active development, prefer:

<ProjectReference Include="..\Spl.Core\Spl.Core.csproj" />

instead of a NuGet package.

Advantages:

• Step into source code
• Hot rebuilds
• Easier debugging
• No package republishing

When the library becomes stable, switch back to:

<PackageReference Include="SplConverter" Version="0.1.0-preview.1" />

Roadmap

• Better SPL parser coverage
• More aggregation functions
• Improved ES|QL generation
• Better diagnostics
• Full parser test suite
• SourceLink support
• CI/CD pipeline

Maintainer

Maintained by Farshid Sar.

NuGet Profile: https://www.nuget.org/profiles/farshidsar

Feedback and feature requests are welcome.

License

MIT