Skip to main content
The genai_estimate_tokens function estimates the number of tokens in a text string. This estimation helps you predict API costs, validate input sizes, and monitor token usage before making actual API calls to LLM services. You can use this function to validate prompt sizes, estimate costs before API calls, monitor content length, or analyze token efficiency across different prompts.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, there’s no direct equivalent for token estimation. You would typically use character or word count as a rough approximation.
| eval estimated_tokens=len(text)/4
In ANSI SQL, you would need to use character-based estimations, which are less accurate than proper token counting.
SELECT 
  text,
  LENGTH(text) / 4 as estimated_tokens
FROM prompts

Usage

Syntax

genai_estimate_tokens(text)

Parameters

  • text (string, required): The text string for which you want to estimate the token count.

Returns

Returns a long integer representing the estimated number of tokens in the input text.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Estimate token usage from prompts in your logs to predict costs and analyze usage patterns.Query
['sample-http-logs']
| where uri contains '/api/chat'
| extend prompt_text = tostring(todynamic(request_body)['prompt'])
| extend estimated_tokens = genai_estimate_tokens(prompt_text)
| summarize avg_tokens = avg(estimated_tokens), max_tokens = max(estimated_tokens) by ['geo.city']
Run in PlaygroundOutput
geo.cityavg_tokensmax_tokens
New York2451024
London198856
This query analyzes prompt token usage patterns across different geographic locations.
  • genai_cost: Calculates the actual cost based on token usage. Use this in combination with token estimates to predict costs.
  • strlen: Returns string length in characters. Use this for a simpler character count without token estimation.
  • string_size: Returns string length in characters. Use this when you need character count instead of token count.
  • genai_input_cost: Calculates input token cost. Combine with token estimation to predict prompt costs.