Reference / deterministic subset

Query support, with the caveats left in view.

Rulattice translates a bounded set of constructs through one canonical model. This page lists what each adapter reads and writes, how meaning is preserved, and what is rejected. A structural match is not proof that the destination schema carries the same meaning.

Supported constructs

Construct	KQL	Splunk SPL	Cortex XQL	CQL / LogScale
Source	`Table`	`index=x`	`dataset = x`	`#event_simpleName=x` / `#repo=x`
Relative time	`TimeGenerated >= ago(1h)`, `between (ago(1h) .. now())`	`earliest=-1h`	`config timeframe = 1h`	`setTimeInterval(start=1h)`, `test(@timestamp >= now() - duration("1h"))`
Boolean logic	`and or not()`	`AND OR NOT`, implicit AND	`and or not`	`and or not !`, implicit AND
Equality	`== != =~ !~`	`= !=` (search), `= == !=` (where)	`= !=`	`= !=`
Numeric compare	`> >= < <=`	same	same	`test(x > 5)`
Contains / prefix / suffix	`contains startswith endswith` (+ `_cs`), `has`	`"v"` (search), `like()`, `match()`	`contains`, `~=`	`"v"`, `/v/i`, `wildcard()`
Lists	`in in~ !in`	`IN ( )`, `in()`	`in ( ) not in`	`in(field=, values=[ ])`
Regex	`matches regex`	`match()`	`~=`	`/re/flags`, `regex()`
Fields	`project project-away`	`fields`, `fields -`, `table`	`fields`, `fields -x`	`select() table() drop()`
Aggregation	`summarize count() dcount() sum() min() max() avg() by`, `count`	`stats count dc sum min max avg BY`	`comp count() count_distinct() ... by`	`groupBy()`, `count()`, `stats()`
Sort / limit	`sort by`, `order by`, `take`, `top`	`sort`, `head`	`sort asc\|desc`, `limit`	`sort()`, `head()`

Semantics that are preserved

Case sensitivity. KQL contains and SPL search are case-insensitive; LogScale field matches are case-sensitive. The model records which one the source used and the output reproduces it, using (?i), /i, =~, lower() or config case_sensitive as needed.
Wildcards vs literals. In SPL where and KQL, * is a literal character. In SPL search and LogScale it is a wildcard. Literal asterisks are escaped in the output and flagged in review.
Time fields. TimeGenerated, _time and @timestamp are bridged automatically.
Aggregate names. count_ (KQL), count (SPL) and _count (LogScale) are tracked symbolically, so a threshold or sort after an aggregation still points at the right column.
Round-trip check. Every output is parsed again in the target language and compared with the source model. A pass means the translation says the same thing structurally.

Schema mapping (opt-in)

Off by default: field names are preserved and known entity fields are flagged. Turn on "Map fields to target data model" to rename them. Every mapping appears as a review item.

Entity	KQL (ASIM)	SPL (CIM)	XQL (XDM)	CQL (Falcon)	LogScale (ECS-style)	Caveat

Known gaps and rejection behavior

Unsupported input returns no partial output. You get the reason instead.

Joins, unions, subsearches, lookups, eval / extend / alter, renames and computed columns.
Time bucketing such as bin(), timechart and bucket(); exact timestamps; snap-to modifiers like -24h@h; week durations.
count(field), which counts non-null values differently on each platform. Use count or distinct count.
Free-text search terms outside SPL, existence tests (field=*), field-to-field comparison, and wildcards with an interior *.
Mixed sort directions for LogScale, and more than one aggregation stage per query.
KQL has is term-based. It is translated as a substring match and flagged, because the substring version can match more events.

Open the translator