IAM key attribute reference
AI summary
About AI summaries.
An IAM key authorizes your requests to send or search events in Imply Lumi from a third-party application. When you create a key, you add and configure an integration for the application. These configuration settings are called IAM key attributes. IAM key attributes include default values for event metadata and configuration parameters to parse events. To learn how Lumi prioritizes assignment for attributes that store default values, see User attribute defaults.
This topic provides reference information on IAM key attributes. Before continuing, make sure you have a basic understanding of the event model and IAM keys.
Global attributes
The global attributes Environment and Team apply to all ingestion integrations.
Lumi assigns these values to the env and team system attributes, respectively.
If you don't set the global attributes, Lumi doesn't create the system attributes.
You can only search system attributes within Lumi.
HEC attributes
HEC attributes configure default fields and indexing settings for the Splunk® HEC integration.
For the list of HEC attributes, see Send events with Splunk HEC.
S2S attributes
S2S attributes configure event parsing for incoming events from universal forwarders. For the full list of S2S attributes and configuration details, see Event parsing for S2S. These properties are available to the following integrations:
For tcpout and httpout, you can define multiple sets of S2S attributes on the same key.
See Conditional attributes.
Lumi doesn't store S2S attributes with the events.
S3 pull attributes
S3 pull attributes configure access management and user attribute defaults for the S3 pull integration. Use this integration to ingest objects in an S3 bucket with a recurring or one-time backfill job. For a list of attributes, see S3 pull.
Federated search attributes
Federated search attributes on a Lumi IAM key control how Splunk accesses and queries Lumi data.
The following table describes the federated search attributes:
| Attribute | Description | Default |
|---|---|---|
| Allowed indexes | Controls which Lumi indexes can be queried through the federated search integration. See Configure allowed indexes for details on the available options. | None |
| Virtual compute pool | Assigns a virtual compute pool to the key for virtual tier access. Applies to Lumi deployments that have the virtual tier enabled. | Depends on how you set up the key. See Virtual tier access. |
| Query timeout | Controls how long a query can run before it is automatically canceled. The timeout value must be between 5 and 60 minutes. | 5 |
| Data model | Contains field mappings to translate between Lumi event fields and data model fields defined in Splunk. Applies to transparent mode federated search only. See Query Lumi events with data models for details on how to configure the JSON object for this attribute. | False |
Virtual tier access
When you create an IAM key with the federated search integration, you choose which virtual compute pool the key uses to query data outside the hot tier. This applies to both managed data in the virtual tier and external data.
The default selection in the Virtual compute pool drop-down depends on how you set up the key:
- If you create a key from the Integrations page, the drop-down defaults to the default pool.
- If you add the federated search integration to an existing key from the Keys page, the drop-down defaults to No virtual tier access.
If your account has no default pool, the drop-down is unavailable. Create a virtual compute pool first, then return to the key.
To use a different pool, select it from the drop-down. To restrict the key to data in the hot tier, select No virtual tier access:
An IAM key can only be assigned to one pool, but a pool can have multiple IAM keys.
When you attach a key to an external data connection, the key defaults to the default pool. If you attach an IAM key to multiple external data connections, changing its pool changes the pool for all of them. To run different workloads on different pools, use a separate key for each workload.
Grafana attributes
Grafana attributes apply to the Grafana integration for searching Lumi events using Grafana Loki.
Use Labels on an IAM key to configure Lumi user attributes as Grafana Loki labels, making them available for filtering and querying in LogQL.
The Lumi index attribute automatically maps to service_name in Grafana.
See Configure user attributes as labels for details.
Learn more
For more information, see the following topics:
- IAM keys to learn about how IAM keys work in Lumi.
- Manage IAM keys to learn how to create and manage an IAM key.
- Lumi concepts for Splunk users to learn how default fields and event parsing relate between Lumi and Splunk.
- Assign Splunk default fields for assigning index, source, or source type attributes.