A network monitor system collects log entries from network appliances in the data network, each log entry including a quantity context related to an activity or a resources usage and a value of the quantity context. The network monitor system receives a spoken question inputting by a user and processes the spoken question. The network monitor determines a question context included in the spoken question, including a quantity entity context, compares the question context with given log entries, and for matching given log entry, stores the quantity context and the value of the quantity context in the given log entry as a result entry in a result entries list. The network monitor system further composes a response according to the result entries and outputs the response for playing to the user.