Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Migrate Splunk detection rules to Microsoft Sentinel

4 September 2026Doc update+43 / −40 lines

In brief

The article now references Sentinel analytics rules and the SIEM migration experience for finding out-of-the-box matches. It also updates SPL-to-KQL section headings, example links, and wording.

What Defender admins need to know

Administrators migrating Splunk rules can more easily find relevant rule-mapping guidance and examples; no configuration change is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Migrate Splunk detection rules to Microsoft Sentinel titleSuffix: Microsoft Sentinel description: Learn how to identify, compare, and migrate your Splunk detection rules to Microsoft Sentinel built-in rules.analytics rules, including use of the SIEM migration experience to find out-of-the-box matches. ms.author: guywild author: guywi-ms ms.reviewer: soulisabag ms.topic: how-to ms.date: 06/15/07/02/2026 ai-usage: ai-assisted ms.custom: msecd-doc-authoring-10141016

#Customer intent: As a security engineer, I want to migrate Splunk detection rules to KQL so that I can leverage advanced machine learning analytics and improve incident detection and response with Microsoft Sentinel.

Migrate Splunk detection rules to Microsoft Sentinel

Splunk detection rules are security information and event management (SIEM) components that compare to analytics rules in Microsoft Sentinel. This article describes the concepts used to identify, compare, and migrate themSplunk detection rules to Microsoft Sentinel. The best way to migrate Splunk detection rules to Microsoft Sentinel is to start with the SIEM migration experience, which identifies out-of-the-box (OOTB) analytics rules for automatic translation.

If you want to migrate your Splunk Observability deployment, learn more about how to migrate from Splunk to Azure Monitor Logs.

Audit rules

Microsoft Sentinel uses machine learning analytics to create high-fidelity and actionable incidents. Some of your existing Splunk detections may be redundant in Microsoft Sentinel, so don't migrate them all Splunk detections blindly. Review the following rule-auditing considerations as you identify your existing detection rules.

Map and compare rule samples

Use the following SPL-to-KQL samplessample tables and examples in this section to compare and map rules from Splunk to Microsoft Sentinel in various scenarios.

CommonCompare common Splunk search commands with KQL examples

The followingThis table maps common SPL search commands to their KQL equivalents in Microsoft Sentinel.

SPL command Description KQL operator KQL example
eval Calculates an expression. Learn about common eval commands. extend `T
fields Removes fields from search results. • project
• project-away		 `T
head/tail Returns the first or last N results. top `T
lookup Adds field values from an external source. • externaldata
• lookup		 Lookup command KQL example
rename Renames a field. Use wildcards to specify multiple fields. project-rename `T
rex Specifies group names using regular expressions to extract fields. matches regex `…
search Filters results to results that match the search expression. search search "X"
sort Sorts the search results by the specified fields. sort `T
stats Provides statistics, optionally grouped by fields. Learn more about common stats commands. summarize Stats command KQL example
mstats Similar to stats, used on metrics instead of events. summarize Mstats command KQL example
table Specifies which fields to keep in the result set, and retains data in tabular format. project `T
top/rare Displays the most or least common values of a field. top `T
transaction Groups search results into transactions.

Transaction command SPL example		 Example: row_window_session Transaction command KQL example
eventstats Generates summary statistics from fields in your events and saves those statistics in a new field.

SPL example		 Examples:
• join
• make_list
• mv-expand		 KQL example
streamstats Find the cumulative sum of a field.

SPL example:
`...		 streamstats sum(bytes) as bytes _ total | timechart` row_cumsum
anomalydetection Find anomalies in the specified field.

SPL example		 series_decompose_anomalies() KQL example

lookup command: KQL example

The followingThis KQL example uses externaldata to replicate the SPL lookup pattern by filtering users against an external data source. 

Users

stats command: KQL example

The followingThis KQL example uses summarize to count transactions and sum totals, grouped by fruit and month. 

Sales

mstats command: KQL example

The followingThis KQL example bins metric values into price ranges and counts the records in each range. 

T | summarize count() by price_range=bin(price, 10.0)

#### `transaction` command: SPL example

The followingThis SPL example groups related start and stop events into a single transaction by activity ID.

```spl
sourcetype=MyLogTable type=Event

transaction command: KQL example

The followingThis KQL example replicates SPL transaction grouping by joining start and stop events on a shared activity ID and calculating the duration. 

let Events = MyLogTable | where type=="Event";

eventstats command: SPL example

The followingThis SPL example calculates per-category event counts in one-minute bins and then appends a per-time-bin total using eventstats. 

… | bin span=1m _time

anomalydetection command: SPL example

The followingThis SPL example detects anomalies in historical closing price data over a 10-year period. 

sourcetype=nasdaq earliest=-10y

anomalydetection command: KQL example

The followingThis KQL example uses time-series analysis functions to detect anomalies in disabled-account sign-in trends over a seven-day lookback period. 

let LookBackPeriod= 7d;
| extend (anomalies,score) =
series_decompose_anomalies(Trend)

CommonCompare common Splunk eval commands with KQL equivalents

The followingThis table maps common SPL eval functions to their KQL equivalents in Microsoft Sentinel.

SPL command Description SPL example KQL command KQL example

case(X,"Y",…) SPL example

The followingThis SPL example returns a different message string based on the HTTP error code. 

case(error == 404, "Not found",

case(X,"Y",…) KQL example

The followingThis KQL example uses case() to assign a message based on the error code value. 

T

if(X,Y,Z) KQL example

The followingThis KQL example uses iif() to label whether a timestamp falls on the current day. 

iif(floor(Timestamp, 1d)==floor(now(), 1d),

isint(X) KQL example

The followingThis KQL example checks whether X has an integer-compatible type by using gettype and iif. 

iif(gettype(X) =="long","TRUE","FALSE")

isstr(X) KQL example

The followingThis KQL example checks whether X is a string value by using gettype and iif. 

iif(gettype(X) =="string","TRUE","FALSE")

like(X,"y") example

The followingThese KQL examples show several string-matching operators you can use to replicate SPL like pattern matching. 

… | where field has "addr"

min(X,…) KQL example

The followingThese KQL examples show different ways to compute minimum values using min_of, min, and arg_min. 

min_of (expr_1, expr_2 ...)

mvfilter(X) KQL example

The followingThis KQL example uses mv-apply to filter and reduce multi-valued content, similar to the SPL mvfilter function. 

T | mv-apply Metric to typeof(real) on

mvjoin(X,Y) KQL example

The followingThis KQL example uses strcat_array to join array elements into a single string with a custom separator. 

strcat_array(dynamic([1, 2, 3]), "->")

relative time(X,Y) KQL example

The followingThis KQL example converts a datetime value to Unix epoch time for relative-time calculations. 

let toUnixTime = (dt:datetime)

replace(X,Y,Z) KQL example

The followingThis KQL example uses replace() with a regex pattern to swap the month and day parts of a date string. 

replace( @'^(\d{1,2})/(\d{1,2})/', @'\2/\1/',date)

strptime(X,Y) KQL example

The followingThis KQL example uses format_datetime to display only the hours and minutes from a datetime value. 

format_datetime(datetime('2017-08-16 11:25:10'),

time() KQL example

The followingThis KQL example formats a datetime value as a time string showing hours, minutes, and seconds. 

format_datetime(datetime(2015-12-14 02:03:04),
<a name="tostringxy"></a>
#### `tostring(X,Y)` description

ReturnsThe SPL `tostring(X,Y)` function converts values to strings and supports several formatting options. It returns a field value of `X` as a string.
- If the value of `X` is a number, `X` is reformatted to a string value.
- If `X` is a boolean value, `X` is reformatted to `TRUE` or `FALSE`.
- If `X` is a number, the second argument `Y` is optional and can either be `hex` (converts `X` to a hexadecimal), `commas` (formats `X` with commas and two decimal places), or `duration` (converts `X` from a time format in seconds to a readable time format: `HH:MM:SS`).

##### `tostring(X,Y)` SPL example

The followingThis `tostring` SPL example returns:

```SPL
foo=615 and foo2=00:10:15:

urldecode(X) SPL example

The followingThis SPL example decodes a URL-encoded string back to its original form. 

urldecode("http%3A%2F%2Fwww.splunk.com%2Fdownload%3Fr%3Dheader")

CommonCompare common Splunk stats commands with KQL exampleequivalents

The followingThis table maps common SPL stats aggregation functions to their KQL equivalents in Microsoft Sentinel.

SPL command Description KQL command KQL example