Skip to main content

Federated search examples

AI summary
Provides example federated queries for searching Imply Lumi events from Splunk®. Demonstrates supported SPL commands for filtering, aggregating, and analyzing event data. Covers basic searches, field operations, time-based analysis, and data enrichment techniques.

About AI summaries.

This topic provides example federated queries that run against Imply Lumi events from Splunk®.

Each example demonstrates a fully supported SPL command, with output shown where it helps illustrate the result. You can run the queries against the example data for tutorials.

See Federated search reference for a full list of SPL commands, syntax, and functions supported by Lumi for federated searches.

note

Federated search queries event data only, not system attributes.

About the examples​

The examples in this topic use transparent mode federated search syntax. Queries that include an index specification search the main index in Lumi:

index=main

To use standard mode, add the federated: prefix and specify the Splunk federated index to query:

index="federated:lumi_main"

For more information on standard and transparent modes, see Search events with Splunk.

Basic event searches​

Use these commands to filter, sort, and refine search results for Lumi events.

fields​

Find all HTTP 400 (Bad Request) events, displaying only the host, source, and method fields in the results:

index=main status=400 | fields host, source, method

Search for events where method is either GET or POST, and show the five most recent results:

index=main method IN (GET, POST) | head 5

rename​

Count events by status code and rename the status field to http_status for clearer labeling in the output:

index=main 
| stats count by status
| rename status AS http_status

replace​

Replace common HTTP methods with more readable action labels and show matching events with method, client IP, and URI path.

index=main 
| replace GET with "Read" POST with "Submit" PUT with "Update" DELETE with "Remove" IN method
| table method clientip uri_path

Example output:

methodclientipuri_path
Submit237.215.7.11/cart
Update183.245.119.215/categories/smart-lighting/color-changing-bulb
Read117.107.171.174/categories/indoor-lighting/aurora-chandelier
Remove140.199.252.124/categories/outdoor-lighting/moonlit-garden-lamp

The search keyword is implied at the beginning of a query. Use search explicitly in nested searches and when filtering later in a query.

Count events by HTTP status, then filter the result to only the 200 and 404 rows:

index=main 
| stats count by status 
| search status=200 OR status=404

Example output:

statuscount
20010
4046

sort​

Retrieve all HTTP 400 (Bad Request) events, show the host, source, and method fields only, and sort the results alphabetically by host:

index=main status=400
| fields host, source, method
| sort host

tail​

Search for all HTTP 400 (Bad Request) events, returning only the last three matching events:

index=main status=400 | tail 3

where​

Retrieve events where the host is web-01 and the status is 200:

index=main
| where host="web-01" AND status=200

Filtering and matching​

Use these commands to extract, compare, and transform field values for more precise filtering.

eval​

Check if useragent contains the string bot and count how many events are from bots versus non-bots:

index=main 
| eval is_bot=if(like(useragent, "%bot%"), "yes", "no")
| stats count by is_bot

Example output:

is_botcount
no254
yes54

regex​

Show only those events where the uri_path matches a two-level category path under /categories/. Display the user and uri_path.

index=main
| regex uri_path="^/categories/[^/]+/[^/]+"
| table user uri_path

Example output:

useruri_path
alice997/categories/indoor-lighting/eclipse-wall-sconce
kennethjohnson/categories/smart-lighting/voice-controlled-bulb
dorothy3321/categories/outdoor-lighting/solar-path-light

rex​

Extract the operating system from the useragent string and display it alongside the user:

index=main 
| rex field=useragent "\((?<os>[^;]+);"
| table user os useragent

Example output:

userosuseragent
admin728Windows NT 10.0Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
parkeranthonyLinuxMozilla/5.0 (Linux; Android 5.1.1; Nexus 5)...
kramercosmoMacintoshMozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6)...

setfields​

Set the host, status, and uri fields to specific values and display the results in a table:

index=main 
| setfields host="10.0.1.19", status="200", uri="/shipping-policy"
| table host, status, uri, _time

uniq​

Remove any result that is an exact duplicate of the result immediately before it, so identical rows collapse into one. Pair with sort to leave a single entry per unique clientip, uri_path, and status combination for a clean view of who hit which failing endpoint.

index=main sourcetype=access_combined status>=400
| table clientip uri_path status
| sort clientip uri_path status
| uniq

Example output:

clientipuri_pathstatus
4.6.50.119/categories/indoor-lighting/nebula-table-lamp404
4.128.3.8/checkout400
4.164.233.112/try-again400
9.67.106.81/product/aurora-chandelier403

Time and aggregation​

Use these commands to group, bucket, and summarize Lumi events over time or by key fields.

bin​

Group events into 1-hour time intervals and count how many events occur in each interval:

index=main
| bin _time span=1h
| stats count by _time
| sort _time

Example output:

_timecount
2025-07-15 00:00:0017
2025-07-15 01:00:0022
2025-07-15 02:00:009
2025-07-15 03:00:0014

bucket​

Round each event’s timestamp down to the nearest hour (3600 seconds), count how many events occurred in each hour, sort them chronologically, and show the first 4 results:

index=main 
| bucket _time span=3600
| stats count by _time
| sort _time
| head 4

Example output:

_timecount
2025-10-17 01:004
2025-10-17 02:001
2025-10-17 03:005
2025-10-17 04:005

chart​

Create a chart showing the request count for each method, broken down by status code over the past 5 days.

index=main earliest=-5d@d
| chart count over method by status

Example output:

Chart example

eventstats​

Add a field to every event showing how many events its user has in the result set:

index=main 
| eventstats count as user_event_count by user

localize​

Scan events matching the sourcetype and status and return the time regions where they cluster, starting a new region whenever the gap between consecutive events exceeds the maxpause value of 5 minutes.

index=main sourcetype=access_combined status>=500
| localize maxpause=5m

stats​

Count the total number of successful requests and the number of unique client IPs:

index=main status=200 
| stats count AS total_requests, dc(clientip) AS unique_ips

Example output:

total_requestsunique_ips
171145

streamstats​

Show a running count of events per user over time, excluding anonymous users, to track how each user’s activity accumulates chronologically:

index=main 
| where user != "-"
| streamstats count as user_request_count by user

timechart​

Create a line chart showing the daily count of events over the past 5 days, with each data point representing a 24-hour period:

index=main earliest=-5d@d 
| timechart span=24h count as requests

Example output:

Timechart example

tstats​

Count the number of events per host:

index=main sourcetype=access_combined
| tstats count AS host_event_count BY host

Example output:

hosthost_event_count
proxy-01211
web-01854

Text and field extraction​

These commands help you extract data from JSON or text fields and format it for analysis.

convert​

Convert _time to an ASCII human-readable time and to the number of milliseconds since epoch, and display a table showing the first 5 results:

index=main
| convert ctime(_time) AS formatted_time
| convert mstime(_time) AS milliseconds
| table _time user formatted_time milliseconds
| head 5

Example output:

_timeuserformatted_timemilliseconds
2025-12-01 00:34:04sallyosborne12/01/2025 00:34:041764549244
2025-12-01 00:28:25trixie929212/01/2025 00:28:251764548905
2025-12-01 00:13:04dorothy332112/01/2025 00:13:041764547984
2025-12-01 00:00:29-12/01/2025 00:00:291764547229
2025-11-30 23:46:17rhawkins11/30/2025 23:46:171764546377

fillnull​

Count events grouped by referer and replace any missing referer values with 0:

index=main
| fillnull
| stats count by referer

Example output:

referercount
https://www.pinterest.com/1
https://www.ebay.com/3
05

Replace missing referer values with a descriptive placeholder to make null values easier to identify:

index=main
| fillnull value="No referer" referer
| table _time user referer

Example output:

_timeuserreferer
2025-12-01 00:34:04sallyosborneNo referer
2025-12-01 00:29:29trixie9292https://techcrunch.com/
2025-12-01 00:28:25-https://www.etsy.com/
2025-12-01 00:13:04dorothy3321No referer

iplocation​

Look up the geographic location of each clientip and display the IP with its city, country, region, latitude, and longitude for the last 4 matching events:

index=main
| iplocation clientip
| table clientip City Country Region lat lon
| tail 4

Example output:

clientipCityCountryRegionlatlon
62.1.162.192AthensGreeceAttica37.983823.7275
218.29.115.104ZhengzhouChinaHenan34.7472113.625
192.135.23.153BolognaItalyEmilia-Romagna44.500411.3568
52.79.96.163SeoulSouth KoreaSeoul37.5665126.978

lookup​

note

This example requires an existing lookup configuration in Splunk. See Enrich Lumi events with Splunk lookups for setup requirements.

Return events where risk_level is medium, with user context from the lookup.

index=main
| lookup user_lookup user OUTPUT role, department, risk_level 
| where risk_level="medium"
| table user, role, department

Example output:

userroledepartment
annabel1883botautomated
timothy992internal_staffoperations
bambismithcontractorexternal

makemv​

Split the uri_path string into a multivalue field by breaking it on the / delimiter, so each path segment becomes an individually addressable value. This lets the query pull out the category segment with mvindex and count HTTP errors per site category.

index=main sourcetype=access_combined status>=400
| makemv delim="/" uri_path
| eval category=mvindex(uri_path, 1)
| stats count AS errors by category status
| sort - errors

mvexpand​

Group events by user to collect all URIs they visited, then expand that list so each URI has its own row for further analysis:

index=main
| stats values(uri_path) as visited_paths by user
| mvexpand visited_paths
| table user visited_paths

Example output:

uservisited_paths
admin728/admin
admin728/phpinfo.php
admin728/product/orion-pendant-light
trixie9292/admin
trixie9292/cart

spath​

Build a small JSON object from each event's clientip, status, and bytes fields, then use spath to parse the status value back out of that JSON into a new parsed_status field.

index=main sourcetype=access_combined status>=400
| head 3
| eval api_response="{\"client\":\"" . clientip . "\",\"status\":" . status . ",\"bytes\":" . bytes . "}"
| spath input=api_response path=status output=parsed_status
| table clientip api_response parsed_status

Example output:

clientipapi_responseparsed_status
134.135.151.108{"client":"134.135.151.108","status":404,"bytes":881}404
20.254.179.85{"client":"20.254.179.85","status":403,"bytes":6351}403
211.15.212.148{"client":"211.15.212.148","status":403,"bytes":6723}403

table​

Display a table of selected fields for easy viewing and analysis:

index=main
| table _time, clientip, status, user

Example output:

_timeclientipstatususer
2025-05-13 14:22:2153.3.39.88200sanderskimberley
2025-05-13 14:22:36147.197.48.174200kevin10
2025-05-13 14:22:58154.24.52.81200cheryl33

Data models​

Use these commands to query against Splunk data models. The query examples use the CIM Web data model with transparent mode federated search.

datamodel​

Return raw Web events from the Web dataset, showing destination, status, source, and URL for each event:

| datamodel Web Web search
| table Web.dest Web.status Web.src Web.url

Example output:

Web.destWeb.statusWeb.srcWeb.url
web-01403109.98.252.15/categories/indoor-lighting/eclipse-wall-sconce
web-01304244.98.46.91/product/eclipse-wall-sconce
web-0120438.126.89.234/checkout

datamodelsimple​

Use this command to explore a data model before writing queries. Return available fields for the Web dataset in the Web data model:

| datamodelsimple type=attributes datamodel=Web nodename=Web.Web

Example output:

attributelineage
categoryWeb.category
dest_priorityWeb.dest_priority
urlWeb.url

pivot​

Generate a count of web events grouped by destination host and HTTP status code:

| pivot Web Web count(Web) AS count splitrow dest splitrow status

Example output:

pivot example

Error and performance analysis​

Use these commands to identify common or rare values, detect anomalies, and analyze performance trends.

rare​

Find the two least common combinations of uri and user, excluding events where the user is - and the uri is /:

index=main 
| where user != "-" AND uri != "/"
| eval combo = uri . " - " . user
| rare limit=2 combo

Example output:

combocountpercent
/.bash_history - admin37410.217865
/.bash_history - elaine55410.217865

sirare​

Find and display statistically rare users among successful requests, excluding anonymous ones:

index=main 
| where user != "-" AND status=200
| sirare user
| table user

sitop​

Identify statistically significant URIs that start with /admin/ and returned a 200 status:

index=main 
| where status=200 AND match(uri_path, "^/admin/")
| sitop uri_path

top​

Show the most common URIs accessed in the index, with how often they appear and their percentage of total events:

index=main | top uri

Example output:

uricountpercent
/home52423.4%
/shipping-policy31213.9%
/contact29012.9%

How to search

Learn more​