SPL is inferior to KQL

Splunk query language, SPL, is a giant turd. To properly use use it you must know how Splunk works, so it’s shit as an abstraction layer.

With KQL it’s all in the query language. If you know it, you know it.