Splunk federated search reference

Once you set up federated search, you can search an index in Imply Lumi using a federated index in Splunk®. With federated search, you use Splunk Search Processing Language (SPL) to query Lumi events.

This reference lists the SPL commands, syntax, and functions supported by Lumi for federated searches.

note

Federated search queries event data only, not system attributes.

Search modes

Lumi supports all Splunk search modes for federated search. See the Splunk documentation on search modes for details.

Compatible SPL commands

The following table describes compatibility of federated search commands with Lumi. Cases when Splunk executes a command at the search head are noted.

Command	Lumi support
search	Fully supported
accum	Executed on the Splunk search head
addcoltotals	Executed on the Splunk search head
addtotals	Executed on the Splunk search head
anomalies	Executed on the Splunk search head
anomalousvalue	Executed on the Splunk search head
anomalydetection	Executed on the Splunk search head
append	Executed on the Splunk search head
appendcols	Executed on the Splunk search head
autoregress	Executed on the Splunk search head
bin	aligntime option not supported; log span (like span=2log10) not supported
bucket	Synonym for bin; aligntime option not supported; log span (like span=2log10) not supported
bucketdir	Executed on the Splunk search head
chart	See supported functions below
cluster	Executed on the Splunk search head
cofilter	Executed on the Splunk search head
collect	Executed on the Splunk search head
concurrency	Executed on the Splunk search head
contingency	Executed on the Splunk search head
correlate	Executed on the Splunk search head
ctable	Executed on the Splunk search head
dbinspect	Executed on the Splunk search head
dedup	Executed on the Splunk search head
delta	Executed on the Splunk search head
diff	Executed on the Splunk search head
eval	See supported functions below
eventcount	Executed on the Splunk search head
eventstats	See supported functions below
fieldformat	Executed on the Splunk search head
fields	Fully supported
fieldsummary	Executed on the Splunk search head
filldown	Executed on the Splunk search head
fillnull	Optional arguments not supported
findtypes	Executed on the Splunk search head
folderize	Executed on the Splunk search head
format	Executed on the Splunk search head
gentimes	Executed on the Splunk search head
gauge	Executed on the Splunk search head
head	eval-expression not supported
highlight	Executed on the Splunk search head
history	Executed on the Splunk search head
inputcsv	Executed on the Splunk search head
inputlookup	Executed on the Splunk search head
iplocation1	Fully supported
join	Executed on the Splunk search head
kmeans	Executed on the Splunk search head
loadjob	Executed on the Splunk search head
localop	Executed on the Splunk search head
makecontinuous	Executed on the Splunk search head
makeresults	Executed on the Splunk search head
map	Executed on the Splunk search head
metadata	Executed on the Splunk search head
mvcombine	Executed on the Splunk search head
nomv	Executed on the Splunk search head
outlier	Executed on the Splunk search head
outputlookup	Executed on the Splunk search head
outputtext	Executed on the Splunk search head
overlap	Executed on the Splunk search head
predict	Executed on the Splunk search head
rare	Fully supported
regex	Fully supported
rename	Wildcard-based renaming of similar fields not supported
replace	Fully supported
rest	Executed on the Splunk search head
return	Executed on the Splunk search head
reverse	Executed on the Splunk search head
rex	mode=sed, offset_field, and non-default max_match not supported
rtorder	Executed on the Splunk search head
scrub	Executed on the Splunk search head
searchtxn	Executed on the Splunk search head
selfjoin	Executed on the Splunk search head
sendalert	Executed on the Splunk search head
sendemail	Executed on the Splunk search head
set	Executed on the Splunk search head
setfields	Fully supported
sirare	Fully supported
sistats	Executed on the Splunk search head
sitop	Fully supported
sort	Sorting on calculated fields not supported
spath	Using without output argument not supported
stats	Optional arguments not supported; see supported functions below
strcat	Executed on the Splunk search head
streamstats	See supported functions below
table	Fully supported
tail	Fully supported
timechart	See supported functions below
timewrap	Executed on the Splunk search head
top	Fully supported
transaction	Executed on the Splunk search head
transpose	Executed on the Splunk search head
trendline	Executed on the Splunk search head
trequire	Executed on the Splunk search head
tstats	Optional arguments not supported; see supported functions below
typeahead	Executed on the Splunk search head
untable	Executed on the Splunk search head
where	See supported functions below
x11	Executed on the Splunk search head
xyseries	Executed on the Splunk search head

Supported syntax

Use the following operators for comparisons and boolean logic in federated searches and where expressions.
Functions such as like and match provide additional pattern-matching options.

Operator/Syntax	Description	Example
=	Equal to	status=200
!=	Not equal to	status!=200
>	Greater than	count>400
>=	Greater than or equal to	total_events>=5000
<	Less than	host_event_count<100
<=	Less than or equal to	percent<=50
""	Exact phrase	#processor="ec 20250806.1487.0"
*	Wildcard matching	uri=*policy*
AND	Match both conditions	method=GET AND status=404
OR	Match either or both conditions	status=500 OR level=error
NOT	Exclude results matching condition	NOT uri="/orders*"
IN	Match any value from a list (in where or eval)	where method IN (GET,POST)
NOT IN	Exclude listed values (in where or eval)	where NOT (user IN ("trixie9292","gusosborne"))
XOR	True when exactly one input is true	where method=PUT XOR status=400
CASE	Case-sensitive match	CASE(Intel)

If a search term includes a space, enclose it in double quotes (").

Wildcard matching

Use * (asterisk) as a wildcard to match any characters within quoted search phrases.
Examples:

• uri_path=/admin*
• user=CASE(*admin*)
• useragent=*bot*
• clientip=192.168.*
• useragent=*"Intel Mac"*
• method="POST" AND uri=*/login*

You can’t search for the asterisk character itself, as it’s reserved for wildcards.
See Splunk wildcard documentation for details.

Evaluation operators

Evaluation expressions use functions and operators to calculate and compare values.
Lumi supports these operators:

• Mathematical: +, -, *, /, %
• Comparison: =, ==, !=, >, >=, <, <= (= and == are equivalent)
• Unary minus: -
• String concatenation: . (for example, first_name . " " . last_name)

Supported evaluation functions

Lumi supports the following evaluation functions:

Function type	Supported functions
Comparison and conditional	case, cidrmatch, coalesce, false, if, like, match, null, nullif, searchmatch, true, validate
Date and time	now, relative_time, strftime, strptime, time
Informational	isbool, isdouble, isint, isnotnull, isnull, isnum, isstr
Mathematical	abs, ceiling / ceil, exp, floor, ln, pi, pow, round, sqrt
Multivalue evaluation	mvappend, mvcount, mvindex, split
Text	len, lower, ltrim, replace, rtrim, spath, substr, trim, upper, urldecode
Trigonometric and hyperbolic	acos, acosh, asin, asinh, atan, atan2, atanh, cos, cosh, hypot, sin, sinh, tan, tanh

Lumi supports Java regular expressions, not Perl-style regex.

Supported statistical and charting functions

Lumi supports the following statistical and charting functions:

Function type	Supported functions
Aggregate functions	avg, c, count, dc, distinct_count, estdc, estc_error, exactperc, max, mean, min, mode, range, stdev, stdevp, sum, sumsq, var, varp
Multivalue stats and chart functions	values
Time functions	earliest, earliest_time, latest, latest_time, rate

Learn more

See the following topics for more information:

• Search events with Splunk to walk through federated search setup and run example queries.
• Federated search examples for more queries that you can run against Lumi tutorial data.
• Splunk search reference for Splunk's SPL reference guide.

Footnotes

1. Lumi derives the location of IPs based on data from the IP to City Lite database by DB-IP. This database is licensed under a Creative Commons CC BY 4.0. ↩