File upload

AI summary

Explains how to upload log files to Imply Lumi for quick ingestion and analysis. Covers file size limits, attribute assignment, and JSON configuration. Shows how to search uploaded file events using system and user attributes.

About AI summaries.

To quickly get started with Imply Lumi, you can upload log files. For a step-by-step guide using file upload, see the Quickstart.

This topic describes requirements and configuration for file upload in Lumi.

Prerequisites

To upload files to Lumi, you need the following:

• Access to Lumi with the Data manager role or higher. For information on roles and permissions, see Manage roles.
• Files in CSV, JSON, Splunk® CSV, Splunk HEC, Parquet or plain text format. For more information, see Event formats.

File size limit

Lumi supports a maximum file size of 200 MB. This limit refers to the size of the file transmitted by the browser or HTTP client.

Assign attributes

You can assign the following attributes during file upload:

Field	Attribute name	Attribute type
Env	env	System attribute
Team	team	System attribute
Source	source	User attribute
Source type	sourcetype	User attribute
Index	index	User attribute

The user attributes represent Splunk default fields. Use these fields to filer searches or meet a pipeline condition. If the file already defines any attributes, the value in the file overrides the one specified in the UI.

Lumi-assigned attributes

Lumi assigns the following system attributes to every event in an uploaded file:

• receiver: imply.file
• file: name of the file

Configure JSON upload

In most cases, Lumi parses events as described in the supported event formats. With JSON format, you can customize how Lumi constructs events.

1. Select Integrations in the navigation menu.

2. Select File upload.

3. Click Select file and select your JSON file.

4. Confirm that Format is JSON.

5. Configure the event timestamp. You can skip this step if Lumi auto-detected the timestamp correctly.

   1. In Time, select the field that contains the timestamp.
   2. In Time format, select the format of the timestamp. See examples of supported timestamp formats.
   3. Optionally set the time zone ID.

6. Configure the event message. Confirm or specify the field in Message. You can specify a single field such as log or combine multiple fields such as stdin,stdout. If you provide multiple fields, Lumi joins the values in the specified order delimited by a space character.

   For example, key1,key2 in the following JSON creates the event message val1 val2:

   {
     "key1": "val1",
     "key2": "val2"
   }

7. Configure user attributes. By default, Lumi creates user attributes for all fields not used for the timestamp or message. To only store a subset of fields, select Allow list > Specify fields. Enter the fields as a comma-separated list. You can't reuse the timestamp or message fields as user attributes.

   

8. Select an event in Parsed preview and confirm your event structure.

9. Click Upload.

Search events from a file

To explore events related only to the file, use the file system attribute in your search. You can also filter by a user attribute specific to the file. For example, add the following filter to your query, and set the appropriate time range:

#file=site_visitors_quickstart.csv

You can search all events with a specific file extension using a wildcard. For example:

#file=*.csv

You can search all events Lumi received by file upload. For example:

#receiver=imply.file

Learn more

For more information, see the following topics:

• Quickstart to learn to send events to Lumi through file upload.
• Event formats to learn about supported event formats.
• Event model to learn about system and user attributes.
• Transform events using pipelines to enrich or transform events sent to Lumi.