Alternative of Splunk query method in KQL method

Rushit Ajudiya 146 Reputation points
2022-05-16T17:41:54.72+00:00

while making the workbook using KQL with reference of Splunk query language, I have encountered some doubt regarding conversion of spl (Splunk query language) methods to KQL as I have not found some particular method of SPL for KQL.  

Some of them are

 - iplocation
 - lookup  
 - values()

so can anyone give exact conversion of Splunk methods for KQL.

Also while exploring the option of lookup I found that ddslookup (or other file) which is the csv file in the Splunk are used in some of the operation in the Splunk query so how can I do it in workbook using KQL.

for example : lookup abc ip AS def

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,800 questions
Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
975 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Alistair Ross 7,101 Reputation points Microsoft Employee
    2022-05-17T09:59:46.907+00:00

    Hello @Rushit Ajudiya

    • ipv4_lookup plugin is the nearest equivalent to iplocation, though there isn't a built in table for IP locations, giving you the flexibility to choose the example table or from another provider. Also note, that some logs, such as Azure AD Sign in logs are already enriched with IP location information. Also IP addresses mapped to entities and Threat Intelligence IP's are also enriched with geolocation data.
    • There is no KQL equivalent to lookup as KQL is a read only language within Log Analytics and therefore doesn't add any new data to the environment. To perform something similar, you would need to ingest data to the environment and perform a join. Ways that you can do this include
    • Watchlists
    • Threat Intelligence
    • Playbook or equivalent method for ingesting data to log analytics
    • externaldata() operator
      • distinct is the operator I believe you want for values()
    1 person found this answer helpful.
  2. Alistair Ross 7,101 Reputation points Microsoft Employee
    2022-05-27T10:25:35.153+00:00

    Hi @Preet Parikh

    There isn't an equivalent in workbooks for Splunk treemap, though this can be achieve easily within PowerBi (desktop version is free). This would be a great suggestion and I would recommend you raise it here https://feedback.azure.com/d365community/forum/3887dc70-2025-ec11-b6e6-000d3a4f09d0

    May I ask that you mark the thread as answered, if I have answered the original question successfully and any additional questions get raised in a separate thread to ensure that other people can find the answers to the questions you ask easily.

    kind regards

    Alistair

    1 person found this answer helpful.
    0 comments