Known limitations

This topic describes known limitations of Imply Lumi in the current release. Reviewing these will help you understand the current scope of Lumi and avoid unexpected results.

Send events

File upload

• Maximum file size for upload is 200 MB.

Splunk®-to-Splunk (S2S)

• Compressed data is not supported when sending events from Splunk® using the S2S protocol.

Transform events

• Extracting on time fields in processors is not supported.

Search events with Lumi

When searching events in the Lumi explore view, Lumi query syntax doesn't support the following:

• Pipes to chain query operations or transform data, for example a | b
• Approximate equals, for example attributeName~=searchterm
• Searching JSON values within an event body
• Splunk Search Processing Language (SPL)
  Note that SPL is supported for federated search.

Search events with Splunk

The following limitations apply to federated search in Lumi.

General limitations

• Lumi only supports the SPL commands listed in Splunk federated search syntax for federated search.
• You can't search for the asterisk character directly because the character is reserved as a wildcard. See Searching for the asterisk character for more information.

Supported commands with limitations

• fillnull: Optional arguments aren't supported.
• rename: Renaming similarly named fields with wildcards isn't supported.
• rex: The following arguments aren't supported:
  • mod=sed
  • offset_field
  • max_match (other than the default max_match=1)
• spath: Can't be used without arguments.
• stats: Optional arguments aren't supported.
• tstats: Optional arguments aren't supported.