Splunk federated search reference

AI summary

Lists SPL commands compatible with federated search in Imply Lumi. Details supported syntax, operators, and functions.

About AI summaries.

Once you set up federated search, you can search Imply Lumi events using a federated provider in Splunk®. With federated search, you use Splunk Search Processing Language (SPL) to query Lumi events.

This reference lists the SPL commands, syntax, and functions supported by Lumi for federated searches. For example queries using SPL commands that are fully supported in Lumi, see Federated search examples.

note

Federated search queries event data only, not system attributes.

Search modes

Lumi supports all Splunk search modes for federated search. See the Splunk documentation on search modes for details.

Compatible SPL commands

The following table describes compatibility of federated search commands with Lumi. Cases when Splunk executes a command at the search head are noted.

Command	Lumi support
search	Fully supported
accum	Executed on the Splunk search head
addcoltotals	Executed on the Splunk search head
addtotals	Executed on the Splunk search head
anomalies	Executed on the Splunk search head
anomalousvalue	Executed on the Splunk search head
anomalydetection	Executed on the Splunk search head
append	Executed on the Splunk search head
appendcols	Executed on the Splunk search head
apply	Executed on the Splunk search head—requires the Splunk AI toolkit and Python for Scientific Computing Splunk add-ons
autoregress	Executed on the Splunk search head
bin	aligntime option not supported; log span (like span=2log10) not supported
bucket	Synonym for bin; aligntime option not supported; log span (like span=2log10) not supported
bucketdir	Executed on the Splunk search head
chart	See supported functions below
cluster	Executed on the Splunk search head
cofilter	Executed on the Splunk search head
collect	Executed on the Splunk search head
concurrency	Executed on the Splunk search head
contingency	Executed on the Splunk search head
convert	Fully supported
correlate	Executed on the Splunk search head
ctable	Executed on the Splunk search head
dbinspect	Executed on the Splunk search head
dedup	Executed on the Splunk search head
delta	Executed on the Splunk search head
diff	Executed on the Splunk search head
eval	See supported functions below
eventcount	Executed on the Splunk search head
eventstats	See supported functions below
fieldformat	Executed on the Splunk search head
fields	Fully supported
fieldsummary	Executed on the Splunk search head
filldown	Executed on the Splunk search head
fillnull	Fully supported
findtypes	Executed on the Splunk search head
fit	Executed on the Splunk search head—requires the Splunk AI toolkit and Python for Scientific Computing Splunk add-ons
folderize	Executed on the Splunk search head
format	Executed on the Splunk search head
gentimes	Executed on the Splunk search head
gauge	Executed on the Splunk search head
head	eval-expression not supported
highlight	Executed on the Splunk search head
history	Executed on the Splunk search head
inputcsv	Executed on the Splunk search head
inputlookup	Executed on the Splunk search head
iplocation1	Fully supported
join	Executed on the Splunk search head
kmeans	Executed on the Splunk search head
loadjob	Executed on the Splunk search head
localop	Executed on the Splunk search head
makecontinuous	Executed on the Splunk search head
makeresults	Executed on the Splunk search head
map	Executed on the Splunk search head
metadata	Executed on the Splunk search head
mvcombine	Executed on the Splunk search head
mvexpand	Fully supported
outlier	Executed on the Splunk search head
outputlookup	Executed on the Splunk search head
outputtext	Executed on the Splunk search head
overlap	Executed on the Splunk search head
predict	Executed on the Splunk search head
rare	Fully supported
regex	Fully supported
rename	Wildcard-based renaming of similar fields not supported
replace	Fully supported
rest	Executed on the Splunk search head
return	Executed on the Splunk search head
reverse	Executed on the Splunk search head
rex	offset_field and non-default max_match not supported
rtorder	Executed on the Splunk search head
scrub	Executed on the Splunk search head
searchtxn	Executed on the Splunk search head
selfjoin	Executed on the Splunk search head
sendalert	Executed on the Splunk search head
sendemail	Executed on the Splunk search head
set	Executed on the Splunk search head
setfields	Fully supported
sirare	Fully supported
sistats	Executed on the Splunk search head
sitop	Fully supported
sort	Optimized for Lumi query processing. Sorting on calculated fields not supported
spath	Using without output argument not supported
stats	delim is the only supported optional argument; see supported functions below
strcat	Executed on the Splunk search head
streamstats	See supported functions below
table	Fully supported
tail	Fully supported
timechart	See supported functions below
timewrap	Executed on the Splunk search head
top	Fully supported
transaction	Executed on the Splunk search head
transpose	Executed on the Splunk search head
trendline	Executed on the Splunk search head
trequire	Executed on the Splunk search head
tstats	Optional arguments not supported; see supported functions below
typeahead	Executed on the Splunk search head
untable	Executed on the Splunk search head
where	See supported functions below
x11	Executed on the Splunk search head
xyseries	Executed on the Splunk search head

Supported syntax

Use the following operators for comparisons and boolean logic in federated searches and where expressions.
Functions such as like and match provide additional pattern-matching options.

Operator/Syntax	Description	Example
=	Equal to	status=200
!=	Not equal to	status!=200
>	Greater than	count>400
>=	Greater than or equal to	total_events>=5000
<	Less than	host_event_count<100
<=	Less than or equal to	percent<=50
""	Exact phrase	#processor="ec 20250806.1487.0"
*	Wildcard matching	uri=*policy*
AND	Match both conditions	method=GET AND status=404
OR	Match either or both conditions	status=500 OR level=error
NOT	Exclude results matching condition	NOT uri="/orders*"
IN	Match any value from a list (in where or eval)	where method IN (GET,POST)
NOT IN	Exclude listed values (in where or eval)	where NOT (user IN ("trixie9292","gusosborne"))
XOR	True when exactly one input is true	where method=PUT XOR status=400
CASE	Case-sensitive match	CASE(Intel)

If a search term includes a space, enclose it in double quotes (").

Wildcard matching

Use * (asterisk) as a wildcard to match any characters within quoted search phrases.
Examples:

• uri_path=/admin*
• user=CASE(*admin*)
• useragent=*bot*
• clientip=192.168.*
• useragent=*"Intel Mac"*
• method="POST" AND uri=*/login*

You can’t search for the asterisk character itself, as it’s reserved for wildcards.
See Splunk wildcard documentation for details.

Wildcard expansion limits

When using wildcards to expand fields (for example, in stats commands), Lumi limits expansion to 10 fields by default to protect system performance. If your queries require more than 10 expanded fields, contact Imply support with your IAM key details to increase the limit.

Query by event indexing timestamp

You can add a Lumi pipeline to capture the ingestion timestamp for each event. For details, see Event indexing time.

Once your events have the indexing timestamp attribute, you can use the _index_earliest and _index_latest modifiers in queries.

For example, the following query searches all events in the federated Lumi main table between January 1-31, 2026:

index="federated:lumi_main" _index_earliest="01/01/2026:08:30:00" _index_latest="01/31/2026:20:00:00"

See the Splunk docs on Time modifiers for more information.

Evaluation operators

Evaluation expressions use functions and operators to calculate and compare values.
Lumi supports these operators:

• Mathematical: +, -, *, /, %
• Comparison: =, ==, !=, >, >=, <, <= (= and == are equivalent)
• Unary minus: -
• String concatenation: . (for example, first_name . " " . last_name)

Supported evaluation functions

Lumi supports the following evaluation functions:

Function type	Supported functions
Bitwise	bit_and, bit_or, bit_not, bit_xor, bit_shift_left, bit_shift_right
Comparison and conditional	case, cidrmatch, coalesce, false, if, like, match, null, nullif, searchmatch, true, validate
Cryptographic	md5, sha1, sha256, sha512
Date and time	now, relative_time, strftime, strptime, time
Informational	isbool, isdouble, isint, isnotnull, isnull, isnum, isstr
Mathematical	abs, ceiling / ceil, exact, exp, floor, ln, log, pi, pow, round, sigfig, sqrt, sum
Multivalue evaluation	commands, mvappend, mvcount, mvdedup, mvfilter, mvfind, mvindex, mvjoin, mvmap, mvrange, mvreverse, mvsort, mvzip, mv_to_json_array, split
Text	len, lower, ltrim, replace, rtrim, spath, substr, trim, upper, urldecode
Trigonometric and hyperbolic	acos, acosh, asin, asinh, atan, atan2, atanh, cos, cosh, hypot, sin, sinh, tan, tanh

Lumi supports Java regular expressions, not Perl-style regex.

Supported statistical and charting functions

Lumi supports the following statistical and charting functions:

Function type	Supported functions
Aggregate functions	avg, c, count, dc, distinct_count, estdc, estc_error, exactperc, max, mean, median, min, mode, perc, range, stdev, stdevp, sum, sumsq, upperperc, var, varp
Event order functions	first, last
Multivalue stats and chart functions	list, values
Stats sparkline functions	See Sparkline function options
Time functions	earliest, earliest_time, latest, latest_time, rate

Learn more

See the following topics for more information:

• Search events with Splunk to walk through federated search setup and run example queries.
• Federated search examples for more queries that you can run against Lumi tutorial data.
• Splunk search reference for Splunk's SPL reference guide.

Footnotes

1. Lumi derives the location of IPs based on data from the IP to City Lite database by DB-IP. This database is licensed under a Creative Commons CC BY 4.0. ↩