Unsupported commands

Some SPL commands are not supported in SPL2.

The conversion tool makes a best-effort attempt to convert unsupported SPL commands into valid SPL2 syntax. For example, the tool can substitute another command for the unsupported command if a suitable equivalent exists, or the tool can embed the unsupported command syntax into the spl1 command.

In the following example, the search contains the top and xyseries SPL commands, which are not supported in SPL2:

search index=main sourcetype=access_* status=200 action=purchase | top categoryId | xyseries categoryId count percent

The conversion tool embeds the top and xyseries commands in the spl1 command, allowing this search to run as a valid SPL2 search.

search index=main sourcetype=access_* status=200 action=purchase | spl1 "| top categoryId" | spl1 "| xyseries categoryId count percent"

from command

The from command in SPL and SPL2 are very different.

The conversion tool maps the SPL from command to the SPL2 from command syntax.

Concatenation

In SPL, the concatenation operator is the period ( . ) character. However, in SPL2 the concatenation operator is the plus ( + ) symbol.

The conversion tool replaces the SPL concatenation operator with the SPL2 concatenation operator.