# Splunk query to Kibana

**URL:** https://discuss.elastic.co/t/splunk-query-to-kibana/187118
**Category:** Kibana
**Created:** [June 24, 2019, 12:21pm UTC](https://discuss.elastic.co/t/splunk-query-to-kibana/187118 "2019-06-24T12:21:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![m.sereda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m.sereda/32/48232_2.png) [@m.sereda](https://discuss.elastic.co/u/m.sereda)
#### Post date: [June 24, 2019, 12:21pm UTC](https://discuss.elastic.co/t/splunk-query-to-kibana/187118/1 "2019-06-24T12:21:54Z")

</div>

How to convert this to kibana query language?

`index=visiona "field id=\"0\" value=\"0110\"" | rex max_match=0 "field id=\"39\" value=\"(?<code>([0-9A-Z]+))\"" | where code = "00" OR code="N0" OR code="91" | timechart count by code`

and this

```
index=visiona sourcetype=fo_csshi "<field id="0" value=\"" | rex max_match=0 "field id=\"2\" value=\"(?<bin>([0-9]+))" |  
where bin in ("544674" ,"547396" ,"547396","455065","455080","472817","477924","490823","477540","524382","477262","477263","523427","416311")
| rex max_match=0 "<service>Transaction service time is (?<servicetime>([0-9]+)) ms</service>" | rex max_match=1 "<field id=\"0\" value=\"(?<msgcode>([0-9]+))\"" | where msgcode="1100" OR msgcode="1120" OR msgcode="1200" OR msgcode="1220" OR msgcode="1420" | stats perc95(servicetime) as czas_procesowania by msgcode | eval check=if((czas_procesowania<250) ,"OK","PROBLEM")

```

And is there any tutorial for rewrite from splunk query to Kibana query?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [June 24, 2019, 5:45pm UTC](https://discuss.elastic.co/t/splunk-query-to-kibana/187118/2 "2019-06-24T17:45:43Z")

</div>

Kibana and Splunk works in very different ways so there is no easy converter. When working with the Elastic stack you generally need to do a lot more work up front with respect to parsing out fields and values. [This blog post](https://www.elastic.co/blog/schema-on-write-vs-schema-on-read) contain a discussion on this topic. Once this is done you can build visualizations with filtering and grouping. As you can see this will require you to rethink your approach.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 22, 2019, 5:45pm UTC](https://discuss.elastic.co/t/splunk-query-to-kibana/187118/3 "2019-07-22T17:45:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.