Skip to main content

Set up Splunk federated search

You can issue queries on Imply Lumi events in Splunk® software. When querying Lumi in Splunk, you use the Splunk query syntax, the Splunk Search Processing Language (SPL). See Federated search reference for the SPL commands supported for Lumi events.

This topic provides details on configuring federated search of Lumi events within Splunk.

Prerequisites​

To set up federated search, you need the following:

  • A Lumi user with the Viewer role or higher. For information on roles and permissions, see Manage roles.
  • A Lumi IAM key. See Create an IAM key for details.

To search Lumi events in Splunk, you need an IAM key to authenticate Lumi as a federated provider.

You don't use any of the IAM key attributes when setting up federated search.

If you assigned attributes on the IAM key before sending events, Lumi enriches the events with those attributes. You can search user attributes from Splunk, but you can only access system attributes within Lumi.

Add a federated provider​

To add Lumi as a federated provider:

  1. In Splunk Web, go to Settings ❯ Federation ❯ Federated Providers > Add federated provider.
  2. Complete the following fields:
    • Provider mode: Standard.
    • Provider name: Name that you'll reference in the federated index.
    • Remote host: Host address provided by Lumi.
    • Service account username: IAM key ID.
    • Service account password: IAM key token.
  3. Complete all other fields based on your specific setup and requirements.
  4. Click Save.

Create a federated index​

To create a federated index in Splunk that reads from the Lumi federated provider:

  1. In Splunk Web, go to Settings ❯ Federation ❯ Federated Indexes > Add federated index.
  2. Select For Splunk to Splunk provider.
  3. Complete the following fields:
    • Federated index name: Descriptive name for the federated index.
      You use the name of the federated index when searching Lumi within Splunk.
    • Federated provider: Name of the Lumi federated provider created in Splunk.
    • Remote dataset: Select Index and enter the name of the Lumi index to search.
      If you have multiple indexes in Lumi that you want to search, create a federated index for each one.
  4. Click Save.

Example​

Consider a Splunk environment in which you have a main index storing your logs. You want to start analyzing events from Lumi alongside these logs. You send events to Lumi into the default index that's also called main.

To search Lumi in Splunk, you complete the following steps:

  • Create a federated provider for Lumi called lumi.
  • Create a federated index called lumi_main.
  • Query Lumi from Splunk using the federated label and index name, federated:lumi_main.

The following diagram illustrates this scenario:

federated search example

Search for events​

Once you configure the federated provider and federated index, you can query Lumi events in Splunk.

To search for Lumi events:

  1. Open the Search & Reporting app in Splunk.

  2. Enter your query into the search bar, using the following syntax to specify the federated index:

    index=federated:FEDERATED_INDEX_NAME

    For example:

    index=federated:lumi_main host=web-01

  3. Use the time range selector next to the search bar to select a time range for the search. The default time range is the past 15 minutes. You can select a preset time range or click Date range to set your own start and end date/time. Splunk search excludes the earliest and latest times.

  4. Press Enter or click the search icon to execute the search.

For federated search examples using supported SPL commands, see Federated search reference.

Learn more​

See the following topics for more information: