A network monitor system collects log entries from network appliances in the data network, each log entry includes a quantity context, a first time context, a first name context, and a value of the quantity context. The network monitor system receives a spoken question inputting by a user and processes the spoken question to determine a question context in the spoken question. The question context includes a second name context, a second time context, and a quantity entity context. The network monitor system compares the question context with one or more given log entries. For each match, the network monitor system stores the quantity context and the value of the quantity context in the given log entry as a result entry in a result entries list. The network monitor system composes a response according to the result entries and outputs the response for playing to the user.