Skip to content
Cyber Unboxed
Practical Experiments

Experiment: Can AI Explain a Splunk Query?

A simple experiment: give an AI assistant a Splunk query, ask it to explain what the query does, and check the explanation against what you know.

2 min readBeginner Sep 3, 2026

Explain Like I'm Not a Hacker

Ask a new colleague to explain a recipe you already know by heart, then check whether they actually understood it.

The 30-second explanation

Take a query you already understand. Ask an assistant to explain it in plain language. Then mark where the explanation is right, vague or wrong.

How it works

  1. 1

    1. Prepare

    Choose three queries and write your own explanations.

  2. 2

    2. Ask

    Use the same prompt for each query.

  3. 3

    3. Compare

    Check against your reference explanations.

  4. 4

    4. Record

    Note strengths, gaps and invented details.

Pick three queries of increasing difficulty: one simple filter, one with a stats command, one with a nested search. Write your own plain-language description of each first, before you ask the assistant anything. Then give each query to the assistant with the same prompt, asking for a step-by-step explanation and its assumptions. Compare what comes back: did it get the meaning right, skip a clause, or invent a field that isn't there? Record the results in a small table. What you're really learning is where you can trust the assistant and where you can't, which matters more than any single score. This article lays out a method for you to run yourself. It stops short of claiming any results of its own.

Real-world example

You supply a query that counts failed logins by source address and filters for high counts. You check whether the assistant explains the threshold, the grouping and the field names correctly, and note any field it mentions that does not exist in your data.

How to spot it

  • Explains what the query 'probably' does

    Guessing rather than reading the logic.

  • Invented fields

    Field names that are not in the query.

  • Skipped clauses

    Parts of the query missing from the explanation.

  • Confident tone with errors

    Wrong details stated without hesitation.

What to do

  1. 1Use non-sensitive sample queries and data only.
  2. 2Score against your own reference explanation, not against how convincing the answer sounds.
  3. 3Repeat with harder queries and note the point at which you stop trusting the output.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading