Skip to main content
The genai_extract_user_prompt function extracts the user’s prompt from a GenAI messages array. It returns the content of the last message with the ‘user’ role, which typically contains the user’s question or request to the AI. You can use this function to analyze user queries, understand common question patterns, perform sentiment analysis on user inputs, or track user behavior and needs.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you would need to filter messages by user role and extract the last one.
| eval user_msgs=mvfilter(match(role, "user"))
| eval user_prompt=mvindex(user_msgs, -1)
In ANSI SQL, you would unnest the array, filter by user role, and select the last message.
SELECT 
  conversation_id,
  content as user_prompt
FROM (
  SELECT *, ROW_NUMBER() OVER (PARTITION BY conversation_id ORDER BY msg_index DESC) as rn
  FROM conversations
  CROSS JOIN UNNEST(messages) WITH OFFSET AS msg_index
  WHERE role = 'user'
) WHERE rn = 1

​
Usage

​
Syntax

genai_extract_user_prompt(messages)

​
Parameters

NameTypeRequiredDescription
messagesdynamicYesAn array of message objects from a GenAI conversation. Each message typically contains role and content fields.

​
Returns

Returns a string containing the content of the last user message in the conversation, or an empty string if no user message is found.

​
Example

Extract the user’s prompt from a GenAI conversation to analyze common questions. Query 
['genai-traces']
| extend user_query = genai_extract_user_prompt(['attributes.gen_ai.input.messages'])
| where isnotempty(user_query)
| summarize query_count = count() by user_query
| top 5 by query_count
Output
user_queryquery_count
How do I reset my password?456
What are your business hours?342
How can I track my order?298
This query identifies the most common user questions, helping you understand user needs and improve responses.