SPL to APL Translator

Type safety: Fields like status are often stored as strings. Always cast before numeric comparison: toint(status) >= 500, not status >= 500.

Critical Differences

1. Time is explicit in APL: SPL time pickers don't translate — add where _time between (ago(1h) .. now())
2. Structure: SPL index=... | command → APL ['dataset'] | operator
3. Join is preview: limited to 50k rows, inner/innerunique/leftouter only
4. cidrmatch args reversed: SPL cidrmatch(cidr, ip) → APL ipv4_is_in_range(ip, cidr)

Core Command Mappings