AQL Cheat Sheet

The following cheat sheet provides reference tables that compare the most frequently used AQL operator queries to their equivalent Kusto or Splunk queries.

Filter Search

	Anomali	Kusto	Splunk
Operator	where	where	search
Example (eventlog)	| where sourcetype contains "CrowdStrike" and image endswith "\pnputil.exe"	|where Session_Id == "c8894ffd-e684-43c9-9125-42adc25cd3fc" and ingestion_time() > ago(24h)	Event.Rule="330009.2" Session.Id="c8894ffd-e684-43c9-9125-42adc25cd3fc" _indextime>-24h
Example (ocsf)	ocsf | where class_name = "Network Activity" and src_endpoint.ip = "192.168.1.10"	—
Notes	Anomali search starts with an implicit select from the eventlog table. Refer to the Common Event Schema for descriptions of fields and example values.	Kusto log queries start from a tabular result set in which a filter is applied.	In Splunk, filtering is the default operation on the current index.

Select Results Table Columns

	Anomali	Kusto	Splunk
Operator	fields	facets	fields
Example (eventlog)	| fields event_time, src, image, command_line	|facet by App_Branch, App_Version	|fields App.Version, App.Platform
Example (ocsf)	ocsf | fields src_endpoint.ip, actor.user.name	—

Aggregate Rows

	Anomali	Kusto	Splunk
Operator	aggr	summarize, join	stats, eventstats
Example (eventlog)	| aggr count by src	|summarize count() by App_Platform, Release_Audience	|stats count by OSEnv, Audience
		|join kind=inner (T1) on _time |project _time, category, count_i, count_total	… |stats count_i by time, category |eventstats sum(count_i) AS count_total by _time_
Example (ocsf)	ocsf | aggr count by src_endpoint.ip, dst_endpoint.port	—

Aggregation over Timespan

	Anomali	Kusto	Splunk
Operator	timetrend	summarize	timechart
Examples	| timetrend count span=1mon   | timetrend count by sourcetype span=10m	summarize EventCount=count() by EventType, Length=bin(Duration, 1d)	timechart span=1m avg(CPU) BY host

Limit Results

	Anomali	Kusto	Splunk
Operator	limit	limit	head
Example	| limit 30	|limit 30	|head 30

Sort Results Table

	Anomali	Kusto	Splunk
Operator	sort	order by	sort
Example	| sort count desc	|order by Data_Hresult, desc	|sort Data.Hresult |reverse

Calculate Fields

	Anomali	Kusto	Splunk
Operator	calc	extend or project	eval
Example	| calc result = case(status = 200, 'OK', status = 404, 'Not found', status = 500, 'Internal Server Error')	StormEvents |project EndTime, StartTime |extend Duration = EndTime - StartTime)	|Event.Rule=330009.2 |eval state= if(Data.Exception = "0", "success", "error")