Skip to main content

Imply Lumi release notes

These release notes provide information about the latest features, improvements, and fixes for Imply Lumi.

September 1, 2026​

Lumi version 2026.08.26-131243

Send data​

  • Added the ability to preview matching S3 objects based on the object filter configured when creating S3 backfills or recurring jobs.

Transform data​

  • Added bit_and, bit_or, bit_xor, bit_not, bit_shift_left, and bit_shift_right bitwise functions to the expression parser.
  • Added a predefined pipeline for F5 BIG-IP logs.
  • Added support for transformations in pipeline import from Splunk® Technology Add-ons for sourcetype values that use regex backreferences.

Lumi Enterprise​

This section includes release notes that are only applicable to Lumi Enterprise deployments.

Minimum Lumi Enterprise Terraform module version: v1.3.0.

  • Upgraded the Lumi Enterprise Terraform module to v2.0.0. By default, the new version deploys all Lumi services in a single shared namespace for new Lumi Enterprise deployments. To migrate from v1.X.X to v2.0.0:
    • Ensure you are on the latest minor version, v1.3.0.
    • Set use_single_namespace to false in main.tf to maintain backward compatibility with your existing deployment.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Fixed a bug where interval-based S3 pull jobs ran simultaneously instead of at the defined intervals after service deployment.
  • Fixed an issue where oversized events sent from universal forwarders using tcpout were dropped due to exceeding the message size limit when default truncation wasn't applied.
  • Fixed timestamp parsing for incoming events so that 1-2 character timestamps return null instead of throwing an error.
  • Fixed a bug where pipelines referencing a renamed or deleted predefined template silently processed no events.
  • Fixed a bug where the key-value processor crashed when the source field contained the literal value null.
  • Fixed a bug in pipeline import from Splunk® Technology Add-ons where isnull and isnotnull calls with non-attribute arguments, such as isnull(coalesce(...)) or isnotnull(mvfind(...)) were incorrectly rejected.
  • Fixed a bug where substr expressions using a 2-argument form, negative start, or non-literal start or length were incorrectly rejected during TA conversion.
  • Fixed a bug where substr expressions in the expression processor shifted the extracted substring one character left.
  • Fixed a bug where the spath function threw an unhandled exception when parsing invalid or malformed JSON input.
  • Fixed a bug where SPL queries using nested if(match(if(match()))) expressions failed to return results.

August 25, 2026​

Lumi version 2026.08.20-232426

Transform data​

  • Added tostring and urldecode functions to the expression parser.
  • Added support for transformations in pipeline import from Splunk® Technology Add-ons when source or host attributes filter by a glob pattern such as [source::.../file*.log].
  • Added multiple modes for handling processor output values when the output attribute already exists. You can now override, replace, or append to the existing attribute.
  • Added support for the foreach SPL command.

Lumi Enterprise​

This section includes release notes that are only applicable to Lumi Enterprise deployments.

Minimum Lumi Enterprise Terraform module version: v1.3.0.

  • Improved pod scheduling reliability.
  • Reduced false alerts caused by failed jobs that were successfully retried.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Security fixes.
  • Fixed a bug that prevented Lumi Enterprise from pulling container images during deployment.
  • Fixed a bug where the HEC receiver and OTel receiver incorrectly rejected multivalue fields containing numeric, boolean, or null scalar elements.
  • Fixed a bug where setting an account name on first login failed for Firefox users due to a background service error.
  • Fixed a bug in pipeline import from Splunk TAs that didn't flatten JSON fields when the TA didn't define KV_MODE, INDEXED_EXTRACTIONS, or AUTO_KV_JSON.
  • Fixed a bug where tstats queries against a data model could scan the wrong set of indexes, so results were incomplete.

August 18, 2026​

Lumi version 2026.08.14-195249

Transform data​

  • Pipeline import now supports Splunk® Technology Add-ons (TAs) packaged as .tar.gz files in addition to .tgz and .spl files
  • General improvements in handling transformations from Splunk TAs in pipeline import.
  • Added character set argument support and fixed whitespace trimming for trim, ltrim, and rtrim in the expression processor.

Search data​

  • Improved SPL query performance.

Federated search​

  • Added support for the eventcount SPL command, which returns event counts per index.
  • Added support for the reltime SPL command.

Monitor usage​

  • Improved the hover and selection popover on bar charts across the Usage and Explorer pages.

Lumi Enterprise​

There are no updates that apply only to Lumi Enterprise in this release.

Minimum Lumi Enterprise Terraform module version: v1.2.1.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Security fixes and improvements.
  • Fixed a bug where queries that included the Splunk federated search provider (splunk_federated_provider=SOME_PROVIDER), returned 0 events.
  • Fixed a bug that caused a generic error when entering an invalid IAM key attribute.
  • Fixed a bug where the My Profile page displayed a broken breadcrumb link to a nonexistent Users page.
  • Improved the identity provider column in the user login list to label System Admin logins correctly and flag entries whose SAML provider has been removed.
  • Fixed a bug where arithmetic expressions containing function calls, such as tonumber(a) + tonumber(b), failed to convert with a "complex expression not supported" error.
  • Fixed len and substr/substring in the pipelines expression parser to count Unicode code points instead of UTF-16 code units, so strings containing emoji or other multi-unit characters now return the same results as Splunk.
  • Fixed a bug where malformed requests to the S2S collector endpoint returned a 500 error, causing Splunk httpout to retry them indefinitely instead of dropping them; malformed frames now return 400 and empty requests return 200.

August 11, 2026​

Lumi version 2026.08.04-181758

Transform data​

  • Added hex as a data type in the grok parser to match hexadecimal values. For example, %{BASE16NUM:flags:hex}.

Federated search​

  • Added support for Splunk verbose mode on stats queries, returning both aggregated results and raw events.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Fixed a bug where S3 object filters using exact filenames, brace expansions, date tokens, or wildcard patterns returned zero matches and ingested nothing.
  • Fixed a bug with the update-client that caused Helm releases to hang in a pending state, blocking all future upgrades.
  • Fixed a bug where plain text log files containing a single comma were wrongly detected as CSV during file upload.
  • Fixed a bug where the date picker in the S3 pull integration would reposition above the input when navigating between months, making date selection difficult.
  • Fixed a bug where Grafana's logs-volume histogram rendered empty bars when querying data using the native LogQL path.

August 4, 2026​

Lumi version 2026.07.29-203512

Send data​

  • Added an option for backfill and poll-based recurring S3 jobs to skip objects previously ingested from SNS.
  • Updated format selectors to include Splunk HEC in file upload, and Parquet and plain text options to S3 jobs.
  • Added the ability to cancel and resume poll-based recurring S3 jobs.
  • Added support for ingesting data from Splunk forwarders configured with compression enabled over S2S connections.

Transform data​

  • Added the ability to import and export pipelines. You can now build pipelines by importing Lumi pipeline configurations and Splunk technical add-ons.
  • Added the json_extract function to the expression processor to extract values from JSON-encoded string fields.

Federated search​

  • Added support for key-value (KV) lookups.
  • Added a warning to affected failed Pivot reports to explain that Lumi doesn't support ad hoc data model acceleration or the tscollect command.

Lumi Enterprise​

There are no changes that apply only to Lumi Enterprise in this release. See the functional areas for more information about this release.

Minimum Lumi Enterprise Terraform module version: 1.2.1.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Fixed a bug where Splunk forwarder load balancer caused duplicate and partial events to be ingested.
  • Fixed a timestamp discrepancy affecting events ingested through universal forwarders using httpout.
  • Fixed a bug where users belonging to multiple organizations could gain elevated permissions by requesting multiple tenant scopes simultaneously.
  • Fixed the AWS permissions policy displayed for recurring S3 pull jobs to include the required s3:ListBucket permission, matching the policy shown for backfill jobs.
  • Fixed a bug where the httpout integration didn't support S2S parsing attributes. Like tcpout, you can now set S2S attributes for universal forwarders using httpout.
  • Fixed a bug where the bootstrap administrator's audit events were invisible on the Access Log page .

July 22, 2026​

Lumi version 2026.07.17-150346

Send data​

  • Added support for recurring S3 ingestion jobs that use polling intervals for continuous file discovery.
  • Added plain text and Parquet formats for file upload.

Search data​

  • Added support for month-based time bins in the bin, stats, and timechart commands, enabling queries such as timechart span=1month to execute successfully.
  • Added support for the uniq SPL command, which removes adjacent duplicate rows by comparing all fields including _time.
  • Added support for the localize SPL command, which converts search results into a local format so they can be processed on the search head.

Lumi Enterprise​

This section includes release notes that are only applicable to Lumi Enterprise deployments.

Minimum Lumi Enterprise Terraform module version: 1.2.0.

  • Added support for specifying custom resource allocations per service type in cluster configurations.

Fixes​

This section includes fixes for both Lumi Cloud and Lumi Enterprise.

  • Security fixes.
  • Fixed a bug where invalid or unauthorized S2S token authentication requests threw unexpected errors instead of the correct authentication failure response.
  • Fixed a bug where corrupt or truncated objects ingested via S3 pull were retried repeatedly for up to 24 hours instead of being dropped after the first failed attempt.
  • Fixed a bug where the setup instructions for the httpout integration incorrectly stated that the sourcetype attribute is added to the IAM key during configuration.
  • Fixed a bug where case-sensitive PCRE patterns did not correctly match multi-byte Unicode characters, which could cause date extraction failures and dropped Splunk HEC requests when input contained emoji or other multi-byte characters.
  • Fixed a bug where large CloudTrail JSON files were read into memory as a single object, causing memory errors.
  • Fixed a regression where the MATCH, REPLACE, MVFIND expression functions and regex-based processors incorrectly matched patterns case-insensitively instead of case-sensitively.
  • Fixed a bug where a nested pipeline processor with a missing or corrupt child pipeline would prevent the parent pipeline from loading correctly.
  • Fixed a bug where CASE and TERM modifiers were not correctly applied when using the searchmatch function in where expressions.
  • Fixed a bug where strftime formatted the fractional seconds of _time as .000 instead of the actual millisecond value.
  • Fixed a database connection timeout that caused segment cleanup tasks to fail when metadata queries exceeded the default 10-second socket timeout on Aurora.

July 14, 2026​

Lumi version 2026.07.08-165203

Send data​

  • Redesigned the integrations home page with an updated layout. Added new tiles to guide setup of ingestion and transformation for common log types.

Search data​

  • Added CASE case-sensitive value matching to Lumi Query Syntax.
  • Improved query performance.

Manage access​

  • Combined the Users and Roles pages into tabs on the Access page for a more streamlined experience.

Fixes​

  • Security fixes.
  • Fixed a bug where like returned no matches when the first argument was a multivalue field, producing incorrect query results.
  • Fixed a bug where tstats queries against a federated data model with an explicit time range in the where clause returned no results.
  • Fixed a bug where users logging in through a SAML provider configured with no default role were incorrectly assigned the Viewer role.
  • Fixed a bug where EventMatcher did not correctly handle Lumi Query Syntax escape semantics for reserved characters and non-ASCII content.
  • Fixed a bug where Loki API queries with specific label value filters failed with a "bad_data: Error executing query" error in Grafana.
  • Fixed a bug where a "Session expired" dialog appeared unexpectedly during login or logout.
  • Fixed a bug where the stats command failed to parse nested field expressions such as count(values(field_name)).
  • Fixed a bug where default attributes set during file upload (source, sourcetype, index, env, team) were applied only to Splunk CSV files and silently dropped for plain text, CSV, JSON, and Parquet.
  • Fixed a bug where spath arguments containing a hyphen character were not parsed correctly.
  • Fixed a bug where spath commands failed to parse paths containing an ampersand (&) character.
  • Fixed a bug where the stats command did not support avg, sum, and mean aggregation functions for sparklines.
  • Fixed a bug where week-based time spans (for example, 1w@w1) were not recognized as valid bin specifications.
  • Fixed a bug where using span=auto in tstats queries returned an invalid timespan error.
  • Fixed a bug where keepalive packets caused query results to not appear in the Splunk UI when results were returned in default time-descending order.

July 7, 2026​

Lumi version 2026.06.30-014941

Send data​

  • Added Parquet as a supported input format for S3 pull. You can now ingest S3 objects in Parquet format generated by systems such as Databricks, Spark, and Amazon Security Lake.
  • Added AWS access key as an authentication option for S3 pull sources, as an alternative to IAM role assumption.

Transform data​

  • Migrated existing pipelines that used deprecated arithmetic and string processors to the expression processor. Processing functionality remains the same.

Search data​

  • Added support for the makemv SPL command.
  • Added support for the CASE function in Lumi search.

Fixes​

  • Security fixes.
  • Fixed a bug where predefined pipeline names and conditions didn't update when the underlying pipeline template changed.
  • Fixed a bug where the match, mvfind, and like expression processor functions caused PCRE-only patterns accepted by the regex parser processor to silently fail at runtime.
  • Fixed a bug where add-ons using two-delimiter key-value extraction, source::/host:: stanzas, or INDEXED_EXTRACTIONS=tsv/csv/psv converted without errors but produced no field extractions at runtime.
  • Fixed a bug where CSV multi-extractors using non-comma delimiters (such as tab or space) produced only a single malformed column instead of the expected fields.
  • Fixed a bug where index-time sourcetype rewrites silently cleared the source type value; these rewrites now correctly route events to the target source type's pipeline, and conversions with dynamic formats are safely skipped with a warning.
  • Fixed a bug where stats command options placed between functions caused a parse failure, preventing valid Splunk-compatible queries from running.
  • Fixed a bug where the delete key confirmation dialog remained stuck in a loading state with no error message when a delete request failed.
  • Fixed a bug where search commands with a leading comma followed by NOT (for example, | search ,NOT) produced an unhelpful parse error instead of a clear message indicating that NOT requires an argument.
  • Fixed a bug where stats commands using decimal percentile functions such as p99.5 returned an unsupported function error.
  • Fixed a bug for incorrect parsing and event splitting for AWS CloudTrail files.
  • Fixed a bug where an unrecognized pipeline processor couldn't be deleted or reordered.
  • Fixed a bug where lookup commands using the event_time_field argument failed to parse and returned a "no viable alternative" error.
  • Fixed a bug where S3 pull backfill and scheduled jobs dropped key-configured attributes, causing events to be ingested without their expected index and sourcetype values.
  • Fixed a bug where events could be ingested before predefined pipelines finished loading.
  • Fixed a bug where the enable/disable confirmation dialog incorrectly referred to processors as pipelines.
  • Fixed a bug where corrupted regex matcher state caused an infinite loop and out-of-memory errors during string extraction.
  • Fixed a bug where queries using an IN filter caused a NullPointerException and failed to return results.
  • Fixed a bug where deleted lookup files were still included in the manifest.

June 30, 2026​

Lumi version 2026.06.29-191658

  • Lumi now supports Splunk® Enterprise 10.4.

June 23, 2026​

Lumi version 2026.06.17-150712

Transform data​

  • Added a predefined pipeline for CrowdStrike FDR, with built-in support for CrowdStrike event and inventory data types.

Fixes​

  • Security fixes.
  • Fixed a bug where queries combining where and table commands failed validation.
  • Fixed a bug where Lumi didn't recognize custom lookup names defined in transforms.conf when they differed from the underlying CSV filename.

June 16, 2026​

Lumi version 2026.06.05-173405

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: ISNUM, SPLIT, MVDEDUP, MVFILTER, MVFIND, MVINDEX, MVJOIN, MVMAP, MVRANGE, MVSORT, MVZIP, AND MV_TO_JSON_ARRAY.
  • Added support for extracting named capture groups as user attributes in the pipeline regex parser.
  • Added predefined pipelines for Palo Alto Networks source types, including general PAN and Traps log categories compatible with the Splunk Add-on for Palo Alto Networks.

Manage access​

  • Removed the deprecated AdministerDataDeletionRules permission. Instead of AdministerDataDeletionRules, the Admin role now uses the AdministerData permission.

Fixes​

  • Fixed a bug where stats count() wasn't treated as equivalent to stats count(*).
  • Fixed a bug where the iplocation command failed to parse field names containing a dot.
  • Fixed a bug where the dedup, sort, and fieldsummary commands failed to parse field names containing reserved keywords such as ip.
  • Fixed a bug where regex patterns with more capturing groups than mapped output fields caused the regex parser to fail.
  • Fixed inconsistencies in predefined pipelines for Zscaler, Linux, and PAN to align with Splunk directives.
  • Fixed a bug to improve S3 backfill reliability.
  • Fixed a bug in the Grafana integration that caused queries with specific label value filters to fail with a "bad_data: Unrecognizable query return shape" error.
  • Fixed a bug where lookup command options such as local=t were not accepted when placed between field expressions or at the end of the query.
  • Fixed a bug where chart and timechart commands failed to parse queries with options such as limit specified before aggregation functions.
  • Fixed a bug where the latest and earliest aggregation functions caused a parse error in the chart command.
  • Fixed a bug where the lookup command failed with a misleading error when output columns were omitted and the lookup table could not be loaded.
  • Fixed a bug where queries combining where and table failed validation.

June 9, 2026​

Lumi version 2026.06.02-075214

Roles and permissions​

  • Added AdministerData permission to the Admin role. This permission enables you to create, update, and delete data management rules.

Transform data​

  • Added functions to the expression processor for ingestion-time transformations: CIDR subnet lookups, POW, TONUMBER, and MVAPPEND.

Search data​

  • Added support for the CASE function in Lumi queries.
  • Added support for using the spath command without specifying a path.

Fixes​

  • The bin command now accepts time spans without a leading number, such as span=h for span=1h, and accepts snap-to syntax like span=1h@h (the snap-to part is ignored).
  • The mvmap function now accepts any multi-value expression as its first argument, such as split or mvfilter, instead of only a field name.
  • Fixed an issue where inputlookup could return incorrect or missing rows when a query paused and resumed mid-execution.
  • Fixed rendering issues in the Pipelines UI.
  • Fixed a login issue where users weren't redirected to the Lumi Management Console after signing in.