Skip to main content

Imply Lumi release notes

These release notes provide information about the latest features, improvements, and fixes for Imply Lumi.

June 30, 2026​

Lumi version 2026.06.29-191658

  • Lumi now supports Splunk Enterprise 10.4

June 23, 2026​

Lumi version 2026.06.17-150712

Transform data​

  • Added a predefined pipeline for CrowdStrike FDR, with built-in support for CrowdStrike event and inventory data types.

Fixes​

  • Security fixes.
  • Fixed a bug where queries combining where and table commands failed validation.
  • Fixed a bug where Lumi didn't recognize custom lookup names defined in transforms.conf when they differed from the underlying CSV filename.

June 16, 2026​

Lumi version 2026.06.05-173405

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: ISNUM, SPLIT, MVDEDUP, MVFILTER, MVFIND, MVINDEX, MVJOIN, MVMAP, MVRANGE, MVSORT, MVZIP, AND MV_TO_JSON_ARRAY.
  • Added support for extracting named capture groups as user attributes in the pipeline regex parser.
  • Added predefined pipelines for Palo Alto Networks source types, including general PAN and Traps log categories compatible with the Splunk Add-on for Palo Alto Networks.

Manage access​

  • Removed the deprecated AdministerDataDeletionRules permission. Instead of AdministerDataDeletionRules, the Admin role now uses the AdministerData permission.

Fixes​

  • Fixed a bug where stats count() wasn't treated as equivalent to stats count(*).
  • Fixed a bug where the iplocation command failed to parse field names containing a dot.
  • Fixed a bug where the dedup, sort, and fieldsummary commands failed to parse field names containing reserved keywords such as ip.
  • Fixed a bug where regex patterns with more capturing groups than mapped output fields caused the regex parser to fail.
  • Fixed inconsistencies in predefined pipelines for Zscaler, Linux, and PAN to align with Splunk directives.
  • Fixed a bug to improve S3 backfill reliability.
  • Fixed a bug in the Grafana integration that caused queries with specific label value filters to fail with a "bad_data: Unrecognizable query return shape" error.
  • Fixed a bug where lookup command options such as local=t were not accepted when placed between field expressions or at the end of the query.
  • Fixed a bug where chart and timechart commands failed to parse queries with options such as limit specified before aggregation functions.
  • Fixed a bug where the latest and earliest aggregation functions caused a parse error in the chart command.
  • Fixed a bug where the lookup command failed with a misleading error when output columns were omitted and the lookup table could not be loaded.
  • Fixed a bug where queries combining where and table failed validation.

June 9, 2026​

Lumi version 2026.06.02-075214

Roles and permissions​

  • Added AdministerData permission to the Admin role. This permission enables you to create, update, and delete data management rules.

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: CIDR subnet lookups, POW, TONUMBER, and MVAPPEND.

Search data​

  • Added support for the CASE function in Lumi queries.
  • Added support for using the spath command without specifying a path.

Fixes​

  • The bin command now accepts time spans without a leading number, such as span=h for span=1h, and accepts snap-to syntax like span=1h@h (the snap-to part is ignored).
  • The mvmap function now accepts any multi-value expression as its first argument, such as split or mvfilter, instead of only a field name.
  • Fixed an issue where inputlookup could return incorrect or missing rows when a query paused and resumed mid-execution.
  • Fixed rendering issues in the Pipelines UI.
  • Fixed a login issue where users weren't redirected to the Lumi Management Console after signing in.