Splunk federated search reference

Once you set up federated search, you can search an index in Imply Lumi using a federated index in Splunk®. With federated search, you use Splunk Search Processing Language (SPL) to query Lumi events.

This reference lists the SPL commands, syntax, and functions supported by Lumi for federated searches.

Search modes

Lumi supports all Splunk search modes for federated search. See the Splunk documentation on search modes for details.

Supported SPL commands

The following table describes Lumi support for federated search commands:

Command	Lumi support
search	Fully supported
bin	Fully supported
chart	See supported functions below
eval	Fully supported
eventstats	See supported functions below
fields	Fully supported
fillnull	Optional arguments are unsupported
head	Fully supported
iplocation	Fully supported
rare	Fully supported
regex	Fully supported
rename	Renaming similarly named fields using wildcards is unsupported
rex	mode=sed, offset_field, and non-default max_match are unsupported
setfields	Fully supported
sirare	Fully supported
sitop	Fully supported
sort	Sorting on calculated fields is unsupported
spath	Use without arguments is unsupported
stats	See supported functions below
streamstats	See supported functions below
table	Fully supported
tail	Fully supported
timechart	See supported functions below
top	Fully supported
tstats	See supported functions below
where	Fully supported

Supported syntax

Use the following operators for comparisons and boolean logic in federated searches and where expressions.
Functions such as like and match provide additional pattern-matching options.

Operator/Syntax	Description	Example
=	Equal to	status=200
!=	Not equal to	status!=200
>	Greater than	count>400
>=	Greater than or equal to	total_events>=5000
<	Less than	host_event_count<100
<=	Less than or equal to	percent<=50
""	Exact phrase	#processor="ec 20250806.1487.0"
*	Wildcard matching	uri=*policy*
AND	Match both conditions	method=GET AND status=404
OR	Match either or both conditions	status=500 OR level=error
NOT	Exclude results matching condition	NOT uri="/orders*"
IN	Match any value from a list (in where or eval)	where method IN (GET,POST)
NOT IN	Exclude listed values (in where or eval)	where NOT (user IN ("trixie9292","gusosborne"))
XOR	True when exactly one input is true	where method=PUT XOR status=400
CASE	Case-sensitive match	CASE(Intel)

If a search term includes a space, enclose it in double quotes (").

Wildcard matching

Use * (asterisk) as a wildcard to match any characters within quoted search phrases.
Examples:

• uri_path=/admin*
• user=CASE(*admin*)
• useragent=*bot*
• clientip=192.168.*
• useragent=*"Intel Mac"*
• method="POST" AND uri=*/login*

You can’t search for the asterisk character itself, as it’s reserved for wildcards.
See Splunk wildcard documentation for details.

Evaluation operators

Evaluation expressions use functions and operators to calculate and compare values.
Lumi supports these operators:

• Mathematical: +, -, *, /, %
• Comparison: =, ==, !=, >, >=, <, <= (= and == are equivalent)
• Unary minus: -
• String concatenation: . (for example, first_name . " " . last_name)

Supported functions

Lumi supports the following functions:

Function type	Supported functions
Comparison and conditional	case, cidrmatch, coalesce, false, if, like, match, null, nullif, searchmatch, true, validate
Date and time	now, relative_time, strftime, strptime, time
Informational	isbool, isdouble, isint, isnotnull, isnull, isnum, isstr
Mathematical	abs, ceiling / ceil, exp, floor, ln, pi, pow, round, sqrt
Multivalue evaluation	mvappend, mvcount, mvindex, split
Text	len, lower, ltrim, replace, rtrim, spath, substr, trim, upper, urldecode

Lumi supports Java regular expressions, not Perl-style regex.

Learn more

See the following topics for more information:

• Search events with Splunk to walk through federated search setup and run example queries.
• Federated search examples for more queries that you can run against Lumi tutorial data.
• Splunk search reference for Splunk's SPL reference guide.