Claude makes dashboards now, Lumi is ready for them
This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.
For Imply Lumi customers, this works on day one. Lumi already exposes a SQL MCP server, so Claude can query that data and turn the results into a dashboard.
See it in action
In the GIF above, Claude is connected to Lumi through the SQL MCP integration. We ask it to “Make me a dashboard using the Lumi dev connector that shows what indexes are available, how many events are in each one, time series of counts, etc. Also give me a LumiQL search / filter bar.”
Claude explores the schema, writes SQL queries, runs them against Lumi, and assembles the dashboard. We describe what we want to see, and Claude handles the queries and charts.
Why it just works: one data layer, many languages
Lumi supports both SPL and SQL natively. The security data analysts search using SPL through Splunk federated search is also available through SQL to tools like Claude.
That means teams can keep their existing Splunk searches, dashboards, and detections while using Claude to explore the same underlying data. They don’t need a separate copy just to support a new interface.
This is the practical value of separating security data from the tools that analyze it. When a new tool comes along, teams have another way to use the data they already retain.
The agentic SOC starts with the data layer
At Splunk .conf26, Imply co-founder and CTO Gian Merlino made the case that the hard part of an agentic SOC is not the agent. Agents don’t query like scheduled detections do. They follow the evidence: one suspicious login turns into questions about the user, the device, the IP and similar activity across months of history. Gian showed an experimental AI SOC that an Imply engineer built in a single day using Claude Code. The harness was the easy part. What made it useful was the data underneath it.
Claude Dashboards is the same lesson applied to the human side of the SOC. Building the dashboard is now the easy part: Claude does it in minutes. What decides whether the dashboard is worth looking at is whether the data layer can answer fast, cheaply and over enough history to matter.
We think this points to something bigger. The SOC interface of the next few years may not live in a SIEM console, or even in Imply’s own UI. It may live in Claude: investigate in a conversation, pin what matters to a dashboard, share it with the team, and hand the next question to an agent. Every one of those steps runs on the same thing: a data layer that speaks the agent’s language.
Your next SOC might just be Claude
If you already run Lumi, you can try this today: connect Claude to Lumi’s SQL MCP server, turn on Dashboards (on Enterprise plans an org owner enables it under Organization settings), and ask your first question.
If you don’t run Lumi yet, the path is short. Keep Splunk, use Lumi underneath it to make more data searchable at lower cost, and point Claude at the same data.
Request a Lumi demo to see how Splunk and Claude can work with the same security data through Lumi.
Related articles
More from Imply on the same topic.
Search your Splunk DDSS archive without restoring it
Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.
Lumi Lounge Recap: 3 Takeaways from Splunk .conf26
The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.
Why You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.
Splunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.
Supercharging Schema-On-Read: Logs in Object Storage Don’t Need a Data Catalog
Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.
Imply Lumi Loglake vs Splunk Federated Search for S3
Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.
A First Look at Lumi Loglake: Query Logs Where They Live
TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.
Imply Lumi Major Release Preview: Continuing the Journey Towards Decoupled Observability/SIEM
We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse. When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access.
Query Lumi from Grafana: Now in Private Preview
Observability has a silo problem. Today, we’re removing another one. Imply Lumi’s Grafana Loki integration is now in Private Preview.
BTG Pactual + Imply Lumi: More Data. Longer Retention. Lower Cost. Without Replacing Splunk.
Most security teams are forced to choose between cost, retention, and performance as data volumes grow. BTG Pactual broke that tradeoff by rethinking the data layer underneath Splunk — without touching a single workflow.
