Skip to main content

Imply Lumi release notes

These release notes provide information about the latest features, improvements, and fixes for Imply Lumi.

August 11, 2026​

Lumi version 2026.08.04-181758

Transform data​

  • Added hex as a data type in the grok parser to match hexadecimal values. For example, %{BASE16NUM:flags:hex}.
  • Added support for Splunk verbose mode on stats queries, returning both aggregated results and raw events.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Fixed a bug where S3 object filters using exact filenames, brace expansions, date tokens, or wildcard patterns returned zero matches and ingested nothing.
  • Fixed a bug with the update-client that caused Helm releases to hang in a pending state, blocking all future upgrades.
  • Fixed a bug where plain text log files containing a single comma were wrongly detected as CSV during file upload.
  • Fixed a bug where the date picker in the S3 pull integration would reposition above the input when navigating between months, making date selection difficult.
  • Fixed a bug where Grafana's logs-volume histogram rendered empty bars when querying data using the native LogQL path.

August 4, 2026​

Lumi version 2026.07.29-203512

Send data​

  • Added an option for backfill and poll-based recurring S3 jobs to skip objects previously ingested from SNS.
  • Updated format selectors to include Splunk HEC in file upload, and Parquet and plain text options to S3 jobs.
  • Added the ability to cancel and resume poll-based recurring S3 jobs.
  • Added support for ingesting data from Splunk forwarders configured with compression enabled over S2S connections.

Transform data​

  • Added the ability to import and export pipelines. You can now build pipelines by importing Lumi pipeline configurations and Splunk technical add-ons.
  • Added the json_extract function to the expression processor to extract values from JSON-encoded string fields.

Federated search​

  • Added support for key-value (KV) lookups.
  • Added a warning to affected failed Pivot reports to explain that Lumi doesn't support ad hoc data model acceleration or the tscollect command.

Lumi Enterprise​

Minimum Lumi Enterprise Terraform module version: 1.2.1.

There are no changes that apply only to Lumi Enterprise in this release. See the functional areas for more information about this release.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Fixed a bug where Splunk forwarder load balancer caused duplicate and partial events to be ingested.
  • Fixed a timestamp discrepancy affecting events ingested through universal forwarders using httpout.
  • Fixed a bug where users belonging to multiple organizations could gain elevated permissions by requesting multiple tenant scopes simultaneously.
  • Fixed the AWS permissions policy displayed for recurring S3 pull jobs to include the required s3:ListBucket permission, matching the policy shown for backfill jobs.
  • Fixed a bug where the httpout integration didn't support S2S parsing attributes. Like tcpout, you can now set S2S attributes for universal forwarders using httpout.
  • Fixed a bug where the bootstrap administrator's audit events were invisible on the Access Log page .

July 22, 2026​

Lumi version 2026.07.17-150346

Send data​

  • Added support for recurring S3 ingestion jobs that use polling intervals for continuous file discovery.
  • Added plain text and Parquet formats for file upload.

Search data​

  • Added support for month-based time bins in the bin, stats, and timechart commands, enabling queries such as timechart span=1month to execute successfully.
  • Added support for the uniq SPL command, which removes adjacent duplicate rows by comparing all fields including _time.
  • Added support for the localize SPL command, which converts search results into a local format so they can be processed on the search head.

Lumi Enterprise​

Minimum Lumi Enterprise Terraform module version: 1.2.0.

This section includes release notes that are only applicable to Lumi Enterprise deployments.

  • Added support for specifying custom resource allocations per service type in cluster configurations.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Security fixes.
  • Fixed a bug where invalid or unauthorized S2S token authentication requests threw unexpected errors instead of the correct authentication failure response.
  • Fixed a bug where corrupt or truncated objects ingested via S3 pull were retried repeatedly for up to 24 hours instead of being dropped after the first failed attempt.
  • Fixed a bug where the setup instructions for the httpout integration incorrectly stated that the sourcetype attribute is added to the IAM key during configuration.
  • Fixed a bug where case-sensitive PCRE patterns did not correctly match multi-byte Unicode characters, which could cause date extraction failures and dropped Splunk HEC requests when input contained emoji or other multi-byte characters.
  • Fixed a bug where large CloudTrail JSON files were read into memory as a single object, causing memory errors.
  • Fixed a regression where the MATCH, REPLACE, MVFIND expression functions and regex-based processors incorrectly matched patterns case-insensitively instead of case-sensitively.
  • Fixed a bug where a nested pipeline processor with a missing or corrupt child pipeline would prevent the parent pipeline from loading correctly.
  • Fixed a bug where CASE and TERM modifiers were not correctly applied when using the searchmatch function in where expressions.
  • Fixed a bug where strftime formatted the fractional seconds of _time as .000 instead of the actual millisecond value.
  • Fixed a database connection timeout that caused segment cleanup tasks to fail when metadata queries exceeded the default 10-second socket timeout on Aurora.

July 14, 2026​

Lumi version 2026.07.08-165203

Send data​

  • Redesigned the integrations home page with an updated layout. Added new tiles to guide setup of ingestion and transformation for common log types.

Search data​

  • Added CASE case-sensitive value matching to Lumi Query Syntax.
  • Improved query performance.

Manage access​

  • Combined the Users and Roles pages into tabs on the Access page for a more streamlined experience.

Manage data​

  • Added LogLake external store management to Lumi, allowing users to create, connect, disconnect, and delete external stores and attach IAM keys through the UI.

Fixes​

  • Security fixes.
  • Fixed a bug where like returned no matches when the first argument was a multivalue field, producing incorrect query results.
  • Fixed a bug where tstats queries against a federated data model with an explicit time range in the where clause returned no results.
  • Fixed a bug where users logging in through a SAML provider configured with no default role were incorrectly assigned the Viewer role.
  • Fixed a bug where EventMatcher did not correctly handle Lumi Query Syntax escape semantics for reserved characters and non-ASCII content.
  • Fixed a bug where Loki API queries with specific label value filters failed with a "bad_data: Error executing query" error in Grafana.
  • Fixed a bug where a "Session expired" dialog appeared unexpectedly during login or logout.
  • Fixed a bug where the stats command failed to parse nested field expressions such as count(values(field_name)).
  • Fixed a bug where default attributes set during file upload (source, sourcetype, index, env, team) were applied only to Splunk CSV files and silently dropped for plain text, CSV, JSON, and Parquet.
  • Fixed a bug where spath arguments containing a hyphen character were not parsed correctly.
  • Fixed a bug where spath commands failed to parse paths containing an ampersand (&) character.
  • Fixed a bug where the stats command did not support avg, sum, and mean aggregation functions for sparklines.
  • Fixed a bug where week-based time spans (for example, 1w@w1) were not recognized as valid bin specifications.
  • Fixed a bug where using span=auto in tstats queries returned an invalid timespan error.
  • Fixed a bug where keepalive packets caused query results to not appear in the Splunk UI when results were returned in default time-descending order.

July 7, 2026​

Lumi version 2026.06.30-014941

Send data​

  • Added Parquet as a supported input format for S3 pull. You can now ingest S3 objects in Parquet format generated by systems such as Databricks, Spark, and Amazon Security Lake.
  • Added AWS access key as an authentication option for S3 pull sources, as an alternative to IAM role assumption.

Transform data​

  • Migrated existing pipelines that used deprecated arithmetic and string processors to the expression processor. Processing functionality remains the same.

Search data​

  • Added support for the makemv SPL command.
  • Added support for the CASE function in Lumi search.

Fixes​

  • Security fixes.
  • Fixed a bug where predefined pipeline names and conditions didn't update when the underlying pipeline template changed.
  • Fixed a bug where the match, mvfind, and like expression processor functions caused PCRE-only patterns accepted by the regex parser processor to silently fail at runtime.
  • Fixed a bug where add-ons using two-delimiter key-value extraction, source::/host:: stanzas, or INDEXED_EXTRACTIONS=tsv/csv/psv converted without errors but produced no field extractions at runtime.
  • Fixed a bug where CSV multi-extractors using non-comma delimiters (such as tab or space) produced only a single malformed column instead of the expected fields.
  • Fixed a bug where index-time sourcetype rewrites silently cleared the sourcetype value; these rewrites now correctly route events to the target sourcetype's pipeline, and conversions with dynamic formats are safely skipped with a warning.
  • Fixed a bug where stats command options placed between functions caused a parse failure, preventing valid Splunk-compatible queries from running.
  • Fixed a bug where the delete key confirmation dialog remained stuck in a loading state with no error message when a delete request failed.
  • Fixed a bug where search commands with a leading comma followed by NOT (for example, | search ,NOT) produced an unhelpful parse error instead of a clear message indicating that NOT requires an argument.
  • Fixed a bug where stats commands using decimal percentile functions such as p99.5 returned an unsupported function error.
  • Fixed a bug for incorrect parsing and event splitting for AWS CloudTrail files.
  • Fixed a bug where an unrecognized pipeline processor couldn't be deleted or reordered.
  • Fixed a bug where lookup commands using the event_time_field argument failed to parse and returned a "no viable alternative" error.
  • Fixed a bug where S3 pull backfill and scheduled jobs dropped key-configured attributes, causing events to be ingested without their expected index and sourcetype values.
  • Fixed a bug where events could be ingested before predefined pipelines finished loading.
  • Fixed a bug where the enable/disable confirmation dialog incorrectly referred to processors as pipelines.
  • Fixed a bug where corrupted regex matcher state caused an infinite loop and out-of-memory errors during string extraction.
  • Fixed a bug where queries using an IN filter caused a NullPointerException and failed to return results.
  • Fixed a bug where deleted lookup files were still included in the manifest.

June 30, 2026​

Lumi version 2026.06.29-191658

  • Lumi now supports Splunk® Enterprise 10.4.

June 23, 2026​

Lumi version 2026.06.17-150712

Transform data​

  • Added a predefined pipeline for CrowdStrike FDR, with built-in support for CrowdStrike event and inventory data types.

Fixes​

  • Security fixes.
  • Fixed a bug where queries combining where and table commands failed validation.
  • Fixed a bug where Lumi didn't recognize custom lookup names defined in transforms.conf when they differed from the underlying CSV filename.

June 16, 2026​

Lumi version 2026.06.05-173405

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: ISNUM, SPLIT, MVDEDUP, MVFILTER, MVFIND, MVINDEX, MVJOIN, MVMAP, MVRANGE, MVSORT, MVZIP, AND MV_TO_JSON_ARRAY.
  • Added support for extracting named capture groups as user attributes in the pipeline regex parser.
  • Added predefined pipelines for Palo Alto Networks source types, including general PAN and Traps log categories compatible with the Splunk Add-on for Palo Alto Networks.

Manage access​

  • Removed the deprecated AdministerDataDeletionRules permission. Instead of AdministerDataDeletionRules, the Admin role now uses the AdministerData permission.

Fixes​

  • Fixed a bug where stats count() wasn't treated as equivalent to stats count(*).
  • Fixed a bug where the iplocation command failed to parse field names containing a dot.
  • Fixed a bug where the dedup, sort, and fieldsummary commands failed to parse field names containing reserved keywords such as ip.
  • Fixed a bug where regex patterns with more capturing groups than mapped output fields caused the regex parser to fail.
  • Fixed inconsistencies in predefined pipelines for Zscaler, Linux, and PAN to align with Splunk directives.
  • Fixed a bug to improve S3 backfill reliability.
  • Fixed a bug in the Grafana integration that caused queries with specific label value filters to fail with a "bad_data: Unrecognizable query return shape" error.
  • Fixed a bug where lookup command options such as local=t were not accepted when placed between field expressions or at the end of the query.
  • Fixed a bug where chart and timechart commands failed to parse queries with options such as limit specified before aggregation functions.
  • Fixed a bug where the latest and earliest aggregation functions caused a parse error in the chart command.
  • Fixed a bug where the lookup command failed with a misleading error when output columns were omitted and the lookup table could not be loaded.
  • Fixed a bug where queries combining where and table failed validation.

June 9, 2026​

Lumi version 2026.06.02-075214

Roles and permissions​

  • Added AdministerData permission to the Admin role. This permission enables you to create, update, and delete data management rules.

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: CIDR subnet lookups, POW, TONUMBER, and MVAPPEND.

Search data​

  • Added support for the CASE function in Lumi queries.
  • Added support for using the spath command without specifying a path.

Fixes​

  • The bin command now accepts time spans without a leading number, such as span=h for span=1h, and accepts snap-to syntax like span=1h@h (the snap-to part is ignored).
  • The mvmap function now accepts any multi-value expression as its first argument, such as split or mvfilter, instead of only a field name.
  • Fixed an issue where inputlookup could return incorrect or missing rows when a query paused and resumed mid-execution.
  • Fixed rendering issues in the Pipelines UI.
  • Fixed a login issue where users weren't redirected to the Lumi Management Console after signing in.