Legal

Affiliation notice

Logline is an independent, open-source project. It is not affiliated with, endorsed by or sponsored by Splunk. Splunk and SPL may be trademarks of their respective owners; they are used on this site only to describe what the engine is compatible with.

What "SPL-compatible" means

"SPL-compatible" is a descriptor, used the way "S3-compatible" describes a storage API: the engine accepts the search language's syntax and aims to return what that syntax is documented to return. It is a separate implementation. It compiles searches to ClickHouse SQL and runs the rest in its own process; no part of it comes from Splunk software.

What is not used

• No Splunk software, free, developer, trial or otherwise, is installed, run or inspected to build or test the engine. The contribution rules forbid it; see how to contribute.
• No text from Splunk documentation is copied into the engine, its docs or this site. Behavior is described in the project's own words with links to the public pages it was read from.
• No Splunk logos, marks or look-alikes appear in the engine, the UI, the repository or this site, and nothing about them is meant to suggest endorsement.

Where differences are documented

Where the engine knowingly behaves differently, the difference is written down as a known deviation in the compatibility matrix, mirrored from the engine's own documentation. Uncertain semantics are flagged in the pull request that introduces them so a reviewer can challenge the reading.

"Logline" is a working name.