The type of the source rule: spl for a Splunk SPL search or saved search definition,
natural_language for a plain-English description of the behavior to detect, or kql
for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.
The type of the source rule:
splfor a Splunk SPL search or saved search definition,natural_languagefor a plain-English description of the behavior to detect, orkqlfor a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded.