The idea is to make it easier for Splunk users to leverage KQL (migrations, hybrid environments, consultants). The way the data (stream) is manipulated is of course different, the goal here is to get a head start before diving into formal KQL documentation.

Please note I've only played for a few hours before writing this 🐣 therefore feedback and suggestions are more than welcome!

If you are looking for code translators or something similar, consider this project (never used though): https://uncoder.io

For me the easiest was to get access to Azure's Data Explorer and start playing from there as it provides multiple datasets for interactiing and even allowing charts/dataviz rendering.

You can also start from MS Tutorials on how to write KQL queries.

Kusto Query Language (KQL) reference doc

Also consider this nice cheatsheet doc from Markus Bakker: https://github.com/marcusbakker/KQL/blob/master/kql_cheat_sheet_v01.pdf

SPL Quick Reference doc can be found here.

Notes:

• In SPL we usually refer to fields instead of columns. In KQL docs there are many references similar to SQL lang.
• In SPL, every command starts with a pipe (|). Likewise, in KQL, each filter prefixed by the pipe is an instance of an operator.
• Aforementioned pipe char (SPL's command prefix) is suppressed from the table below for simplicity, except for multi-line examples.
• Of course, some commands are better compared from a "use case" perspective, therefore no 1-to-1 mapping possible as each language has its particularities.

head 

take 

table <field(s)>

project <field(s)>

fields - <field(s)>

project-away <field(s)>

rename source_addr AS src_ip

project-rename source_addr = src_ip

search OS="win"

where OS contains "win"

where OS="Windows 10"

where OS=="Windows 10"

search OS="windows 10"

where OS=~"windows 10"

search OS IN ("windows", "linux")

where OS in~ ("windows", "linux")

where match(OS, "")

where OS matches regex ""

eval shake = milk."+".fruit

extend shake = strcat(milk, "+", fruit)

| makeresults
| eval fruit="strawberry"
| eval emo=if(
  match(fruit,"berry"), ":)", ":("
  )
| fields - fruit, _time

print fruit="blueberry", _time=now()
| project emo=iff(fruit contains_cs "berry",":)",":(")

eval sum = num1 + num2

extend sum = num1 + num2

base search for StormEvents
| stats count AS c1

StormEvents
| summarize c1=count()

base search for StormEvents
| stats count(eval(len(State)>10)) AS c1

StormEvents
| summarize c1=countif(strlen(State)>10)

base search for StormEvents
| stats dc(eval(match(state, "^I"))) AS c1

StormEvents
| summarize c1=dcountif(State, State startswith "I")

base search for StormEvents
| stats c by State, EventType
| sort 5 -num(c)

StormEvents
| summarize c=count() by State, EventType
| top 5 by c

base search for StormEvents
| top 5 State

StormEvents
| summarize c=count() by State
| top-hitters 5 of State by c

| bin _time span=1d
| eval DoY=strftime(_time, "%j")