Skip to main content
The genai_extract_function_results function extracts function call results from GenAI messages. When an AI model uses function calling (also known as tool calling), the results are stored in specific message roles. This function retrieves those results for analysis. You can use this function to monitor function call outcomes, debug tool integrations, analyze API usage patterns, or track the effectiveness of function calls in AI workflows.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you would need to use complex filtering and extraction logic to isolate function results from nested message structures.
| eval function_results=mvfilter(match(role, "function") OR match(role, "tool"))
| eval results=mvindex(function_results, 0)
In ANSI SQL, you would need to unnest arrays and filter for function or tool roles, which is more complex.
SELECT 
  conversation_id,
  JSON_EXTRACT(content, '$.result') as function_results
FROM conversations
CROSS JOIN UNNEST(messages)
WHERE role IN ('function', 'tool')

​
Usage

​
Syntax

genai_extract_function_results(messages)

​
Parameters

  • messages (dynamic, required): An array of message objects from a GenAI conversation. Each message typically contains role and content fields.

​
Returns

Returns a dynamic object containing the function call results from the conversation, or null if no function results are found.

​
Use case examples

  • Log analysis
  • OpenTelemetry traces
  • Security logs
Extract function call results to analyze which external tools and APIs are being used by your AI system.Query
['sample-http-logs']
| where uri contains '/api/chat'
| extend function_results = genai_extract_function_results(todynamic(response_body)['messages'])
| where isnotnull(function_results)
| project _time, id, req_duration_ms, function_results
Run in PlaygroundOutput
_timeidreq_duration_msfunction_results
2024-01-15T10:30:00Zuser_1232450{"status": "success", "data": {"temperature": 72, "humidity": 45}}
2024-01-15T10:31:00Zuser_4561980{"status": "success", "data": {"balance": 1250.50}}
This query shows function call results and correlates them with request duration, helping you understand tool execution performance.
  • genai_extract_tool_calls: Extracts the tool call requests. Use this to see what functions were requested, while genai_extract_function_results shows the results.
  • genai_has_tool_calls: Checks if messages contain tool calls. Use this to filter conversations that use function calling.
  • genai_get_content_by_role: Gets content by specific role. Use this for more granular extraction when you need specific role messages.
  • genai_extract_assistant_response: Extracts assistant responses. Use this when you need the AI’s text response instead of function results.