No More "Digging" Through Logs: Designing AI as a Pre-processor for Human Decision-Making

System alerts never stop. In daily operations, engineers were expected to open Splunk, search for the relevant logs, read through long error messages and stack traces, and then determine the impact and whether any action was required. This process imposed a high cognitive load and created a psychological barrier for the team. As a result, initial responses tended to depend on specific individuals, triage was sometimes delayed, and our regular alert review meetings became longer and increasingly exhausting.

In this session, we will share a practical case study of AI-driven operations that helped us reduce “alert fatigue” and shorten a daily alert review meeting from more than 30 minutes to just 5–10 minutes—less than one third of the original time. By integrating our internal FaaS platform, Funk, with the Splunk API and generative AI through ChatAI Proxy, we built an architecture that allows the entire workflow—from log collection to root-cause analysis and decision support—to be completed directly in Slack.

The session will cover:

A system architecture for event-driven automated log retrieval using an internal FaaS platform and the Splunk API
A UX shift from “humans search for and read logs” to “AI translates logs and delivers diagnostic insights”
Techniques for improving AI diagnosis accuracy by incorporating past incident-handling examples into prompts
A design approach that combines rule-based automation, such as automatic reactions, with LLM-based reasoning to reduce the burden of human decision-making
Practical points for building an operations flow that stays within Slack instead of forcing engineers to move across multiple tools
This is not just a story about trying out generative AI. It is a hands-on example of how to embed AI into an existing operations workflow and dramatically reduce the cognitive load on engineers.

Attendees who struggle with daily alert handling or operational maintenance, as well as those who want to integrate generative AI into real business workflows and achieve tangible results, will gain reusable design patterns and operational know-how that can be applied immediately in their own teams.

Transcript

1. 1 2026.06.29 LY Corporation No More “Digging” Through Logs: Designing AI as a Pre-processor for Human Decision-Making Toshiki Nagasaki / LY Corporation (Search Ad Development Unit)
2. Toshiki Nagasaki ⻑崎 俊紀 Search Ad Development Unit 2017: Developed image inspection systems at an SI company 2019: Developed search engines for e-commerce and restaurant services 2025: Joined LY Corporation as a search ads backend engineer
3. When Alert Operations Became Too Heavy  Operational Challenge • Daily meetings often exceeded 60 minutes • The team faced high cognitive load Problems  Daily Alert Review • Checks all overnight alerts • Share knowledge on system status and incidents • Assign tasks and set deadlines for resolution Team Event
4. When Alert Operations Became Too Heavy  Operational Challenge • Daily meetings often exceeded 60 minutes • The team faced high cognitive load Problems  Daily Alert Review • Checks all overnight alerts • Share knowledge on system status and incidents • Assign tasks and set deadlines for resolution Team Event
5. When Alert Operations Became Too Heavy  Operational Challenge • Daily meetings often exceeded 60 minutes • The team faced high cognitive load Problems  Daily Alert Review • Checks all overnight alerts • Share knowledge on system status and incidents • Assign tasks and set deadlines for resolution Team Event
6. Dramatic Improvements with Log DB API & AI 1. Complete within Slack ◦ Everything needed to decide, in Slack 2. Access to Past Cases ◦ AI refers to past cases 3. Accelerated Onboarding ◦ AI summarizes, translates, and explains Daily Alert Review Meeting Time Over 60 min → Within 10 min
7. When Alert Operations Became Too Heavy Identifying the Bottleneck What We Automated with AI The Reality Behind AI in Operations Lessons Learned from Practice 1 3 2 4 5 Agenda
8. Identifying the Bottleneck
9. Alert Response Before Automation  Slack Notificati on via Monitorin g System  Open Log Managem ent Tool  Search & Interpret Logs  Post Analysis & Decision  Create a Ticket & Assign an Owner
10. Alert Response Before Automation  Slack Notificati on via Monitorin g System  Open Log Managem ent Tool  Search & Interpret Logs  Post Analysis & Decision  Create a Ticket & Assign an Owner
11. Alert Response Before Automation  Slack Notificati on via Monitorin g System  Open Log Managem ent Tool  Search & Interpret Logs  Post Analysis & Decision  Create a Ticket & Assign an Owner
12. Alert Response Before Automation  Slack Notificati on via Monitorin g System  Open Log Managem ent Tool  Search & Interpret Logs  Post Analysis & Decision  Create a Ticket & Assign an Owner
13. Alert Response Before Automation  Slack Notificati on via Monitorin g System  Open Log Managem ent Tool  Search & Interpret Logs  Post Analysis & Decision  Create a Ticket & Assign an Owner Tool switching and manual log interpretation created heavy cognitive load before decisions.
14. 1. Why Was Log Search So Difficult? 1. Alert Notification 2. Search Logs 3. Post Findings to Slack ① ② ③
15. 1. Why Was Log Search So Difficult? • Slack only tells us that an alert has fired • Without human action, there isnʼt enough information to decide whether action is needed • Shortcut links use time-based filters, so delayed checks make it harder to find the relevant logs Immediate alert response is hard in real operations, especially alongside regular work
16. 2. Why Was Analysis and Decision-Making So Hard? Deciding whether action is needed requires • Programming knowledge • Log-reading experience • Operational context Especially hard for new members It's a timeout, but can we ignore it? Reading long system messages is painful
17. ① Let bring logs into Slack ② Let AI translate the logs
18. AI-Powered Log Digging Message Trigger Log DB API Raw Log Internal FaaS via AI Proxy GPT etc. Translate/Summarize logs into human-understandable language  
19. AI-Powered Log Digging Message Trigger Log DB API Raw Log Internal FaaS via AI Proxy GPT etc. Translate/Summarize logs into human-understandable language  
20. AI-Powered Log Digging Message Trigger Log DB API Raw Log Internal FaaS via AI Proxy GPT etc. Translate/Summarize logs into human-understandable language  
21. Engineers can focus on decisions, not digging. Feels like having a helpful teammate in Slack. • Logs come to Slack automatically • No more manual time-window adjustments • No tool switching between tools Solution 1: Bring Logs into Slack
22. Solution 2: AI-Powered "Translation" and "Diagnosis" AI turns massive logs into decision-ready information • Severity & Summary • Context & Impact • Recommended Actions
23. Improvement Results  Alert meetings reduced to 1/6 Not just faster ‒ more confident decisions
24. The Reality Behind AI in Operations
25. AI Also Needs Onboarding  Test env. ≠ Immediate action required  One-off issues can be covered by retries  Tracked issues can be monitored until resolved Logs alone are not enough. AI needs operational context.
26. Operational Context for AI Triage ❏ Add past cases and environment info to prompt ❏ Include team knowledge and policies AI triage closer to human judgement Let AI cover “operatiolnal workuarounds”
27. Rule-Based UX for Faster Decisions ❏ Pre-placed Action Reactions ❏ UI for instant situational awareness AI + Rules = Faster Decisions
28. AI Flags Unknown Issues
29. Lessons Learned from Practice
30. Lesson 1: Start Small You donʼt need to build a large AI system from day one. Even just bringing logs into Slack can make operations easier. Once you start, the next AI opportunities become clear.
31. Lesson 2: Design for the UX Bottleneck Donʼt try to solve everything with AI. Identify where your team gets stuck. Design to reduce the real operational burden. (Tool switching, Log digging, Missing context, etc.)
32. Lesson 3: Input Operational Context AI systems are not finished once they are built. Keep updating prompts and context so AI fits real operations. That is what makes it a tool we can rely on.
33. Welcome an AI Colleague to Your Team Not to replace human decisions But to support us Thank you!
34. Appendix
35. Trademarks & Disclaimers ▪ Trademarks Splunk and Splunk> are trademarks or registered trademarks of Splunk LLC in the United States and other countries. Slack is a trademark and service mark of Slack Technologies, Inc., registered in the U.S. and in other countries. All other company names, product names, and service names are trademarks or registered trademarks of their respective owners. ▪ Disclaimer • This presentation is provided for informational purposes only and does not constitute sponsorship, endorsement, or recommendation by Splunk LLC, Slack Technologies, Inc., or their affiliates. • The information contained herein is as of the date of creation and is subject to change without notice. • We assume no responsibility or liability for any damages arising from the use of this presentation.