Differences from Splunk
KubeSense SPL follows Splunk's, so most Splunk searches run unchanged. This page lists where it differs.
Data
- One index. All your logs are in one place, scoped by the time range and clusters chosen in the Log Explorer.
index=…is accepted and ignored. - Field names. Log fields have their own names (see Built-in Field Names):
_time,_raw,hostandsourcework as in Splunk;sourcetypedoes not exist. - Attributes are text. They behave as numbers in comparisons, arithmetic, sorting,
min/maxand numeric aggregations, as in Splunk. A field that does not exist reads as empty and matches nothing, rather than causing an error. - Quotes. Single and double quotes both make text. Splunk's
'field name'for a field inevalis not supported.
Commands That Work Differently
| Command | Difference |
|---|---|
search | On the built-in log fields, a value matches as typed, in lower case, in upper case or capitalized (error, ERROR, Error), not in every mix of cases; attribute values match in any case |
timechart … by | One row per bucket and series, not one column per series. Use chart or xyseries for columns. As in Splunk, the 10 largest series are kept (limit=) and the rest combined as OTHER |
fields | Columns left out can still be read by later commands, as in CloudWatch Logs Insights |
| Searches at the start of a query | Several unquoted words need search in front (search error timeout), so a mistyped command is an error |
search operators | and, or and not also work in lower case |
predict | A straight-line trend (algorithm=LLT); other algorithms, period=, correlate= and suppress= are not supported |
cluster | Groups messages that differ only in numbers, IDs and quoted values; t=, match= and delims= are not supported |
anomalydetection | histogram puts numbers into 10 equal ranges and checks each field on its own |
transaction | maxspan splits a transaction into pieces of that length from its first event; its fields hold distinct values |
timewrap | Series are named relative to the latest period; series=relative and align=end only |
map | At most 100 searches; a row's values may not add commands or subsearches to the search |
eventcount | One row for all your logs (index is main) |
tstats | Reads the pre-aggregated log tables: dimension fields and log counts only, and spans in multiples of 5 seconds (see tstats) |
lookup | Reads reference tables, and needs Log Pipeline access; no automatic lookups, time-based lookups or KV store |
strptime | Returns a time rather than epoch seconds; strftime(t, "%s") gives epoch seconds |
| Subsearches | Return at most 10,000 rows; append, appendcols, union and join subsearches at most 50,000 (maxout= lowers it). maxtime= and timeout= are accepted; the query's own time limit applies |
chart, xyseries | At most 1000 columns, for one aggregation |
stats … by | Rows whose by field is missing form their own group, with the field empty, rather than being dropped |
| Spans shorter than a second | bin, timechart and chart take us, ms, cs and ds spans; tstats, timewrap, streamstats time_window=, transaction maxspan=/maxpause=, aligntime= and predict need a whole number of seconds |
Not Supported
A Splunk command or option that KubeSense SPL does not have fails with … is not supported and the reason, rather than returning different results. Options SPL cannot honour are accepted only with the value that asks for what SPL does anyway, such as dedup keepevents=false.
| Command | Why |
|---|---|
outputlookup, collect, outputcsv | They write data. Edit reference tables under Settings → Reference Tables; keep results with Query Jobs |
sendemail | Use alerts for notifications |
rest, metadata, dbinspect | They read Splunk's own configuration and indexes |
datamodel, pivot, from | There are no data models |
savedsearch, loadjob, map saved_search= | Saved searches are not available in SPL; open a Query Job's results from Query Jobs |
iplocation, geostats, geom | There is no IP location database or map data |
kmeans, fit, apply and other machine-learning commands | Not available |
mstats, mcatalog | Query metrics in Dashboards & Metrics |
| Option | Why |
|---|---|
timechart format=, sep=, where=; chart format=, sep=, agg=; xyseries grouped=true, sep=, format= | Columns are named by the values; use limit= to keep the largest |
streamstats reset_before= / reset_after= | Use reset_on_change= |
eventstats / streamstats allnum=true | Numeric aggregations skip values that are not numbers |
join left= / right= / where= / usetime=true | Name the join fields instead; rows join by field values |
dedup keepevents=true | dedup removes the duplicate rows |
extract limit=, maxchars=, mv_add=true, auto=false | extract reads every pair in the message, keeping a key's first value |
rex offset_field= | Match positions are not available |
makemv setsv=true, mvcombine delim= | The field stays a multivalue field; use mvjoin() for text |
makeresults annotate=true | Add fields with eval |
transaction mvlist=true, mvraw=true, connected=false, nullstr=, delim= | A transaction's fields hold their distinct values |
format options | A subsearch's rows are matched directly, not as search text |
tojson | Build JSON with eval and json_object() |
tstats prestats=true, append=true, fillnull_value= | tstats returns results like stats; use fillnull after it |
lookup event_time_field=, inputlookup append=true | Reference tables are not time-based; inputlookup must come first |
selfjoin overwrite=false, max= other than 1 | Each row joins one other row, whose values replace its own |
anomalydetection cutoff=false, outlier type= other than num | Not available |
append extendtimerange=true | A subsearch reads the query's time range |
foreach mode= other than multifield | foreach runs over fields |