Imply Lumi Major Release Preview: Continuing the Journey Towards Decoupled Observability/SIEM
We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse.
When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access. Since then, we have worked closely with numerous enterprise customers (some examples here, here, and here) to bring that vision to life, making more observability data accessible while preserving existing workflows.
Splunk has been the first ecosystem we have deeply integrated with, enabling organizations to optimize and extend existing environments without disrupting the workflows they already rely on. This next phase of Lumi expands that vision even further.
Query Unstructured Logs Where They Live
Imply Lumi Loglake is the next major expansion of the observability warehouse.
It enables teams to query unstructured logs directly where they live in object storage.
As observability data volumes continue to grow, many organizations are rethinking the economics of traditional indexing architectures. At modern observability/SIEM scale, fully indexing everything has become economically impractical.
In response, teams are increasingly moving logs into object storage for cost and flexibility. But once the data is there, it is still difficult to use for observability/SIEM workloads. Complex data pipelines, predefined schemas, and rehydration workflows often get in the way of actually working with the data.
Loglake removes those barriers.
Instead of forcing teams to prepare and move data before they can work with it, Lumi can query unstructured logs directly in object storage without requiring a predefined schema. No pipelines to build. No data to rehydrate. No additional infrastructure to manage.
This is about making data in object storage immediately usable for real world observability workloads as simply and as cheaply as possible.
Expanding the Observability Ecosystem
Loglake is only one part of this next phase of Lumi. We are also expanding how the observability warehouse integrates across the broader observability ecosystem.
Most organizations are not looking to replace the tools they already rely on. They want a simpler way to make more of their observability data accessible across those environments.
That is why Lumi continues to expand support for the platforms teams already use for storage, visualization, and ingestion.
With Databricks, teams can query observability data directly where it lives in the lakehouse without requiring additional pipelines, transformations, or data movement.
With Grafana, teams can access the same observability data in Lumi directly from the dashboards they already use, without duplication or additional pipelines. You can learn more in our blog, Query Lumi from Grafana Now in Private Preview.
With expanded SPL support including search head SPL, teams can continue using the same Splunk queries, dashboards, and operational workflows while accessing far more data through Lumi.
The goal is not to force teams into a new ecosystem. It is to make observability data easier to access and work with across the environments teams already have.
Smarter Infrastructure Management for Modern Observability
Alongside new query capabilities and ecosystem integrations, this next phase of Lumi also introduces new approaches to managing observability infrastructure at scale.
Not all observability workloads behave the same way. Some observability workloads require fast, always on access for monitoring and detection. Others are bursty and investigative in nature, only queried during incidents, compliance requests, or historical analysis.
Lumi is designed to align infrastructure to those different access patterns.
With Virtual Tier and Elastic Compute, teams can keep data in lower cost storage while dynamically routing investigative workloads to elastic compute resources only when needed.
Real time observability workloads remain isolated from large scale historical investigations, allowing teams to scale each independently without forcing always on infrastructure across all data.
This architecture is already being used by customers like BTG Pactual to extend their Splunk environments with longer retention, broader visibility, and more scalable investigations.
To learn more, check out our BTG Pactual ebook:
BTG Pactual ebook
The result is a more decoupled observability architecture where investigative workloads can scale independently without forcing teams to pay for always on infrastructure across all data.
Continuing the Shift Toward Decoupled Observability/SIEM
Observability/SIEM architectures are continuing to shift toward more decoupled models, where storage, compute, and access can scale independently while preserving the workflows teams already rely on.
Over the next few weeks, we will share deeper looks at the capabilities coming to Lumi, including Loglake, ecosystem integrations, and new approaches to elastic observability infrastructure.
We will formally showcase these new capabilities at the Databricks Data + AI Summit in San Francisco (6/15), where we will be hosting demos, technical sessions, and live discussions about the future of decoupled observability architectures.
If you are attending the summit, stop by the Imply booth (#571) to see Lumi in action!
Related articles
More from Imply on the same topic.
Search your Splunk DDSS archive without restoring it
Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.
Claude makes dashboards now, Lumi is ready for them
This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.
Lumi Lounge Recap: 3 Takeaways from Splunk .conf26
The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.
Why You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.
Splunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.
Supercharging Schema-On-Read: Logs in Object Storage Don’t Need a Data Catalog
Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.
Imply Lumi Loglake vs Splunk Federated Search for S3
Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.
A First Look at Lumi Loglake: Query Logs Where They Live
TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.
Query Lumi from Grafana: Now in Private Preview
Observability has a silo problem. Today, we’re removing another one. Imply Lumi’s Grafana Loki integration is now in Private Preview.
BTG Pactual + Imply Lumi: More Data. Longer Retention. Lower Cost. Without Replacing Splunk.
Most security teams are forced to choose between cost, retention, and performance as data volumes grow. BTG Pactual broke that tradeoff by rethinking the data layer underneath Splunk — without touching a single workflow.
