Skip to main content

Known limitations

This topic describes known limitations of Imply Lumi in the current release. Reviewing these will help you understand the current scope of Lumi and avoid unexpected results.

Send events​

File upload​

  • Maximum file size for upload is 200 MB.

Splunk®-to-Splunk (S2S)​

  • Compressed data is not supported when sending events from Splunk® using the S2S protocol.

Transform events​

  • Extracting on time fields in processors is not supported.

Search events with Lumi​

When searching events in the Lumi explore view, Lumi query syntax doesn't support the following:

  • Pipes to chain query operations or transform data, for example a | b
  • Approximate equals, for example attributeName~=searchterm
  • Searching JSON values within an event body
  • Splunk Search Processing Language (SPL)
    Note that SPL is supported for federated search.

Search events with Splunk​

Lumi only supports the SPL commands listed in Splunk federated search syntax for federated search.

Supported commands with limitations:

  • fillnull: Optional arguments are not supported.
  • rename: Renaming similarly named fields with wildcards is not supported.
  • rex: The following arguments are not supported:
    • mod=sed
    • offset_field
    • max_match apart from the default max_match=1
  • stats: Optional arguments are not supported.
  • tstats: Optional arguments are not supported.