Who Uses ChatGPT or Other AI for SPL Queries? 👀
Hey yall! I just wrapped up Module 8 of the SIEM Analyst Foundations with Splunk course. For Part 2B (creating tables displaying the average ages by gender for the Orlando Police Data), I had trouble coming up with SPL queries on my own, so I used ChatGPT... For example, the original dataset that I downloaded (March 2026) included several events w/ multiple officers (along w/ multiple genders and ages, like case # 25-157903). This made my table appear inaccurate because I knew all of the officers' ages and genders were not being taken into account. I figured ChatGPT would be useful and it was! Had my table looking pretty good and clean, and suggested commands that weren't introduced yet. I originally came up with the following SPL query, to find the average age of officers by gender (1st screenshot): source="OPD_Officer-Involved_Shootings_20260318.csv" host="AllInOneServer" index="orlando_policedata" sourcetype="csv" | stats avg("Officer Age") as "Average Officer Age" by "Officer Gender" And transformed it into the following SPL query, which split the groups of officer age and gender into single rows of data to be parsed (2nd screenshot): source="OPD_Officer-Involved_Shootings_20260318.csv" host="AllInOneServer" index="orlando_policedata" sourcetype="csv" | eval gender_list=split('Officer Gender', ", "), age_list=split('Officer Age', ", ") | eval officer_pairs=mvzip(gender_list, age_list, "|") | mvexpand officer_pairs | eval "Officer Gender"=mvindex(split(officer_pairs, "|"), 0), "Officer Age"=tonumber(mvindex(split(officer_pairs, "|"), 1)) | search "Officer Gender" IN ("M","F") | stats avg("Officer Age") as avg_age by "Officer Gender" | eval "Average Officer Age"=round(avg_age,0) | table "Officer Gender", "Average Officer Age" Using ChatGPT helped me to complete the assignment, but I'm trying to gauge how good we should be at being searching for things, like the average age of officers, or if we should be able to generate this info with what we've learned so far.