https://www.mutlu.ch/?p=46
Splunk SPL VS Microsoft KQL