Skip to main content

Imply Lumi release notes

These release notes provide information about the latest features, improvements, and fixes for Imply Lumi.

July 14, 2026​

Lumi version 2026.07.08-165203

Send data​

  • Added support for recurring S3 ingestion jobs, allowing you to schedule automatic data pulls at a fixed interval.
  • Added IAM key attributes to configure Splunk line-breaking and merging for S2S tcpout and HEC.
  • Redesigned the integrations home page with an updated layout. Added new tiles to guide setup of ingestion and transformation for common log types.

Search data​

  • Added CASE case-sensitive value matching to Lumi Query Syntax.
  • Improved query performance.

Manage access​

  • Combined the Users and Roles pages into tabs on the Access page for a more streamlined experience.

Manage data​

  • Added LogLake external store management to Lumi, allowing users to create, connect, disconnect, and delete external stores and attach IAM keys through the UI.

Fixes​

  • Security fixes.
  • Fixed a bug where like returned no matches when the first argument was a multivalue field, producing incorrect query results.
  • Fixed a bug where tstats queries against a federated data model with an explicit time range in the where clause returned no results.
  • Fixed a bug where users logging in through a SAML provider configured with no default role were incorrectly assigned the Viewer role.
  • Fixed a bug where EventMatcher did not correctly handle Lumi Query Syntax escape semantics for reserved characters and non-ASCII content.
  • Fixed a bug where Loki API queries with specific label value filters failed with a "bad_data: Error executing query" error in Grafana.
  • Fixed a bug where a "Session expired" dialog appeared unexpectedly during login or logout.
  • Fixed a bug where the stats command failed to parse nested field expressions such as count(values(field_name)).
  • Fixed a bug where default attributes set during file upload (source, sourcetype, index, env, team) were applied only to Splunk CSV files and silently dropped for plain text, CSV, JSON, and Parquet.
  • Fixed a bug where spath arguments containing a hyphen character were not parsed correctly.
  • Fixed a bug where spath commands failed to parse paths containing an ampersand (&) character.
  • Fixed a bug where the stats command did not support avg, sum, and mean aggregation functions for sparklines.
  • Fixed a bug where week-based time spans (for example, 1w@w1) were not recognized as valid bin specifications.
  • Fixed a bug where using span=auto in tstats queries returned an invalid timespan error.
  • Fixed a bug where keepalive packets caused query results to not appear in the Splunk UI when results were returned in default time-descending order.

July 7, 2026​

Lumi version 2026.06.30-014941

Send data​

  • Added Parquet as a supported input format for S3 pull. You can now ingest S3 objects in Parquet format generated by systems such as Databricks, Spark, and Amazon Security Lake.
  • Added AWS access key as an authentication option for S3 pull sources, as an alternative to IAM role assumption.

Transform data​

  • Migrated existing pipelines that used deprecated arithmetic and string processors to the expression processor. Processing functionality remains the same.

Search data​

  • Added support for the makemv SPL command.
  • Added support for the CASE function in Lumi search.

Fixes​

  • Security fixes.
  • Fixed a bug where predefined pipeline names and conditions didn't update when the underlying pipeline template changed.
  • Fixed a bug where the match, mvfind, and like expression processor functions caused PCRE-only patterns accepted by the regex parser processor to silently fail at runtime.
  • Fixed a bug where add-ons using two-delimiter key-value extraction, source::/host:: stanzas, or INDEXED_EXTRACTIONS=tsv/csv/psv converted without errors but produced no field extractions at runtime.
  • Fixed a bug where CSV multi-extractors using non-comma delimiters (such as tab or space) produced only a single malformed column instead of the expected fields.
  • Fixed a bug where index-time sourcetype rewrites silently cleared the sourcetype value; these rewrites now correctly route events to the target sourcetype's pipeline, and conversions with dynamic formats are safely skipped with a warning.
  • Fixed a bug where stats command options placed between functions caused a parse failure, preventing valid Splunk-compatible queries from running.
  • Fixed a bug where the delete key confirmation dialog remained stuck in a loading state with no error message when a delete request failed.
  • Fixed a bug where search commands with a leading comma followed by NOT (for example, | search ,NOT) produced an unhelpful parse error instead of a clear message indicating that NOT requires an argument.
  • Fixed a bug where stats commands using decimal percentile functions such as p99.5 returned an unsupported function error.
  • Fixed a bug for incorrect parsing and event splitting for AWS CloudTrail files.
  • Fixed a bug where an unrecognized pipeline processor couldn't be deleted or reordered.
  • Fixed a bug where lookup commands using the event_time_field argument failed to parse and returned a "no viable alternative" error.
  • Fixed a bug where S3 pull backfill and scheduled jobs dropped key-configured attributes, causing events to be ingested without their expected index and sourcetype values.
  • Fixed a bug where events could be ingested before predefined pipelines finished loading.
  • Fixed a bug where the enable/disable confirmation dialog incorrectly referred to processors as pipelines.
  • Fixed a bug where corrupted regex matcher state caused an infinite loop and out-of-memory errors during string extraction.
  • Fixed a bug where queries using an IN filter caused a NullPointerException and failed to return results.
  • Fixed a bug where deleted lookup files were still included in the manifest.

June 30, 2026​

Lumi version 2026.06.29-191658

  • Lumi now supports Splunk® Enterprise 10.4.

June 23, 2026​

Lumi version 2026.06.17-150712

Transform data​

  • Added a predefined pipeline for CrowdStrike FDR, with built-in support for CrowdStrike event and inventory data types.

Fixes​

  • Security fixes.
  • Fixed a bug where queries combining where and table commands failed validation.
  • Fixed a bug where Lumi didn't recognize custom lookup names defined in transforms.conf when they differed from the underlying CSV filename.

June 16, 2026​

Lumi version 2026.06.05-173405

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: ISNUM, SPLIT, MVDEDUP, MVFILTER, MVFIND, MVINDEX, MVJOIN, MVMAP, MVRANGE, MVSORT, MVZIP, AND MV_TO_JSON_ARRAY.
  • Added support for extracting named capture groups as user attributes in the pipeline regex parser.
  • Added predefined pipelines for Palo Alto Networks source types, including general PAN and Traps log categories compatible with the Splunk Add-on for Palo Alto Networks.

Manage access​

  • Removed the deprecated AdministerDataDeletionRules permission. Instead of AdministerDataDeletionRules, the Admin role now uses the AdministerData permission.

Fixes​

  • Fixed a bug where stats count() wasn't treated as equivalent to stats count(*).
  • Fixed a bug where the iplocation command failed to parse field names containing a dot.
  • Fixed a bug where the dedup, sort, and fieldsummary commands failed to parse field names containing reserved keywords such as ip.
  • Fixed a bug where regex patterns with more capturing groups than mapped output fields caused the regex parser to fail.
  • Fixed inconsistencies in predefined pipelines for Zscaler, Linux, and PAN to align with Splunk directives.
  • Fixed a bug to improve S3 backfill reliability.
  • Fixed a bug in the Grafana integration that caused queries with specific label value filters to fail with a "bad_data: Unrecognizable query return shape" error.
  • Fixed a bug where lookup command options such as local=t were not accepted when placed between field expressions or at the end of the query.
  • Fixed a bug where chart and timechart commands failed to parse queries with options such as limit specified before aggregation functions.
  • Fixed a bug where the latest and earliest aggregation functions caused a parse error in the chart command.
  • Fixed a bug where the lookup command failed with a misleading error when output columns were omitted and the lookup table could not be loaded.
  • Fixed a bug where queries combining where and table failed validation.

June 9, 2026​

Lumi version 2026.06.02-075214

Roles and permissions​

  • Added AdministerData permission to the Admin role. This permission enables you to create, update, and delete data management rules.

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: CIDR subnet lookups, POW, TONUMBER, and MVAPPEND.

Search data​

  • Added support for the CASE function in Lumi queries.
  • Added support for using the spath command without specifying a path.

Fixes​

  • The bin command now accepts time spans without a leading number, such as span=h for span=1h, and accepts snap-to syntax like span=1h@h (the snap-to part is ignored).
  • The mvmap function now accepts any multi-value expression as its first argument, such as split or mvfilter, instead of only a field name.
  • Fixed an issue where inputlookup could return incorrect or missing rows when a query paused and resumed mid-execution.
  • Fixed rendering issues in the Pipelines UI.
  • Fixed a login issue where users weren't redirected to the Lumi Management Console after signing in.