Skip to main content

Receivers reference

A receiver in Imply Lumi is a service that accepts incoming data like events or search requests. Each ingestion integration is assigned a receiver, and, in some cases, multiple integrations share the same receiver.

Each event in Lumi stores metadata on the receiver as a system attribute. When you use multiple ingestion integrations, you can filter events by their receiver to identify where the events came from.

This topic describes the how you can use receiver information and lists the receivers in Lumi.

Use cases​

You can use the receiver to analyze usage, understand metrics, and filter searches:

  • To understand important sources of event data, visit the usage page. The usage page displays the volume of data ingested by each receiver. Note that you don't view the metrics for a specific integration, but rather the receiver for that integration.

  • To view the high-level ingestion activity for a specific IAM key, visit the IAM key's details page. The details page shows the number of ingested and unparsable events for each receiver over the past 24 hours.

  • To analyze events by their source, filter by the receiver when you issue a query from the explore page. You can only access system attributes within Lumi.

    For example, use the receiver to drill down in your searches, identify a set of events that require transformation, or troubleshoot which application sent corrupted data.

Receivers​

This section lists the receivers in Lumi and their associated ingestion integrations.

Note that usage and IAM key metrics don't apply to file upload.

View event receiver​

To view the receiver for an event:

  1. Go to the Explore view.
  2. Search for and select the event.
  3. Select the tab System attributes.
  4. View the value in receiver. View event receiver

To filter events by this attribute, add receiver to your search expression. For example, #receiver=splunk.s2s.

Learn more​

For more information, see the following topics: