Skip to main content
The genai_extract_assistant_response function extracts the assistant’s response from a GenAI messages array. It returns the content of the last message with the ‘assistant’ role, which typically contains the AI model’s generated response to the user. You can use this function to analyze AI responses, evaluate response quality, perform sentiment analysis on AI outputs, or track specific response patterns for monitoring and debugging.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you would need to use complex eval statements with mvfilter and mvindex to extract assistant messages.
| eval assistant_msgs=mvfilter(match(role, "assistant"))
| eval response=mvindex(assistant_msgs, -1)
In ANSI SQL, you would need to unnest arrays, filter by role, and select the last message, which is more verbose.
SELECT 
  conversation_id,
  content as assistant_response
FROM (
  SELECT *, ROW_NUMBER() OVER (PARTITION BY conversation_id ORDER BY msg_index DESC) as rn
  FROM conversations
  CROSS JOIN UNNEST(messages) WITH OFFSET AS msg_index
  WHERE role = 'assistant'
) WHERE rn = 1

Usage

Syntax

genai_extract_assistant_response(messages)

Parameters

  • messages (dynamic, required): An array of message objects from a GenAI conversation. Each message typically contains role and content fields.

Returns

Returns a string containing the content of the last assistant message in the conversation, or an empty string if no assistant message is found.

Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Extract AI responses from conversation logs to analyze response quality and patterns.Query
['sample-http-logs']
| where uri contains '/api/chat'
| extend ai_response = genai_extract_assistant_response(todynamic(response_body)['messages'])
| where strlen(ai_response) > 0
| project _time, id, req_duration_ms, ai_response
Run in PlaygroundOutput
_timeidreq_duration_msai_response
2024-01-15T10:30:00Zuser_1231250To reset your password, click on the ‘Forgot Password’ link on the login page.
2024-01-15T10:31:00Zuser_456980Our business hours are Monday to Friday, 9 AM to 5 PM EST.
This query extracts AI responses and correlates them with response times, helping you analyze performance.