Skip to content
Cyber Unboxed
Practical Experiments

Experiment: Can AI Explain a Splunk Query?

A simple test you can run yourself: give an assistant a query, ask it to explain it, and check the explanation against what you know.

2 min readBeginner Sep 3, 2026

Explain Like I'm Not a Hacker

It is asking a new colleague to explain a recipe you already know, and checking they understood it.

The 30-second explanation

Take a query you already understand. Ask an assistant to explain it in plain language. Then mark where the explanation is right, vague or wrong.

How it works

  1. 1

    1. Prepare

    Choose three queries and write your own explanations.

  2. 2

    2. Ask

    Use the same prompt for each query.

  3. 3

    3. Compare

    Check against your reference explanations.

  4. 4

    4. Record

    Note strengths, gaps and invented details.

Pick three queries: one simple, one with a stats command, one with a nested search. Write your own plain-language description of each first. Then give each query to the assistant with the same prompt, asking for a step-by-step explanation and its assumptions. Compare: did it get the meaning right, did it skip a clause, did it invent a field? Record the results in a small table. The value is not a score; it is learning where you can trust it and where you should not. This article describes a method, not a set of results.

Real-world example

You supply a query that counts failed logins by source address and filters for high counts. You check whether the assistant explains the threshold, the grouping and the field names correctly, and note any field it mentions that does not exist in your data.

How to spot it

  • Explains what the query 'probably' does

    Guessing rather than reading the logic.

  • Invented fields

    Field names that are not in the query.

  • Skipped clauses

    Parts of the query missing from the explanation.

  • Confident tone with errors

    Wrong details stated without hesitation.

What to do

  1. 1Use non-sensitive sample queries and data only.
  2. 2Score against your own reference explanation, not against how convincing the answer sounds.
  3. 3Repeat with harder queries and note the point at which you stop trusting the output.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading