Convert a search from SPL to SPL2

Use the conversion tools provided in the Search & Reporting app to convert searches from SPL to SPL2.

In the Search & Reporting app, the Search page and the SPL2 module editor both include conversion tools to assist you in converting SPL to SPL2. Use these conversion tools as resources for getting started if you are familiar with SPL but not SPL2, and to migrate existing SPL searches so that they can be enhanced with SPL2 features.

Note: These conversion tools do not support reverting searches from SPL2 back to SPL. If you want to run a search as SPL after converting it, you must manually re-enter the search using SPL syntax. To preserve a copy of your SPL search, copy and paste it to another location before applying the conversion.

See the following pages for more information about converting SPL searches to SPL2:

SPL to SPL2 conversion tools in other products

For information about using the conversion tools in other products that support SPL2:

Edge Processor on Splunk Cloud Platform

See SPL to SPL2 conversion tool in the Use Edge Processors for Splunk Cloud Platform manual.

Edge Processor on Splunk Enterprise

See SPL to SPL2 conversion tool in the Use Edge Processors for Splunk Enterprise manual.

Ingest Processor

See SPL to SPL2 conversion tool in the Use Ingest Processor manual.