Query Lumi from Grafana: Now in Private Preview
Observability has a silo problem. Today, we’re removing another one.
Imply Lumi’s Grafana Loki integration is now in Private Preview. The same logs you’ve loaded into Lumi for Splunk are now queryable natively in Grafana using LogQL with no second pipeline, no duplicate storage, and no custom integrations.
And Grafana is just the next stop, many more ecosystems are on the way.
One dataset. Multiple ecosystems
Today, if you run Splunk and Grafana you pay for it twice:
- Two ingestion pipelines
- Two copies of data
- Two retention strategies to manage.
With Lumi underneath, one ingest feeds everything.
SPL queries from Splunk and LogQL queries from Grafana run on the same dataset, governed once, stored once, and billed once.
This changes how you can think about tools.
Load data into Lumi. Decide later how you want to query it..
Native Loki, not a plugin
The Grafana integration isn’t a custom data source plugin.
Lumi presents itself to Grafana as a Loki backend, so everything Grafana already supports just works:
- LogQL in Explore, including the visual query builder and code mode
- Log panels in dashboards
- Logs Drilldown
- Alerting on log queries
- Label browser populated from your Lumi user attributes
- Existing Loki-based integrations
Grafana users keep the workflow they already have. Admins keep the integrations they’ve already built.
Setup in minutes
From the Lumi Integrations page:
- Select the Grafana tile
- Choose your IAM key
- Map attributes to indexed labels or structured metadata
In Grafana, add a Loki data source and paste in the URL, IAM key ID, and token that Lumi provides.
Once the connection tests successfully, run LogQL against any Lumi index you have access to:
Full setup instructions, including guidance on choosing between indexed labels and structured metadata, are in the Lumi docs.
Getting access
The Grafana integration is in Private Preview. Reach out to your Imply contact or contact us to enable it.
Why this matters
If you’re running both Splunk and Grafana today, you’re probably duplicating data and pipelines just to support both.
With Imply Lumi as your data layer, you don’t have to.
One ingest. One copy of the data. Query it from wherever you want.
Related articles
More from Imply on the same topic.
Search your Splunk DDSS archive without restoring it
Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.
Claude makes dashboards now, Lumi is ready for them
This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.
Lumi Lounge Recap: 3 Takeaways from Splunk .conf26
The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.
Why You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.
Splunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.
Supercharging Schema-On-Read: Logs in Object Storage Don’t Need a Data Catalog
Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.
Imply Lumi Loglake vs Splunk Federated Search for S3
Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.
A First Look at Lumi Loglake: Query Logs Where They Live
TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.
Imply Lumi Major Release Preview: Continuing the Journey Towards Decoupled Observability/SIEM
We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse. When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access.
BTG Pactual + Imply Lumi: More Data. Longer Retention. Lower Cost. Without Replacing Splunk.
Most security teams are forced to choose between cost, retention, and performance as data volumes grow. BTG Pactual broke that tradeoff by rethinking the data layer underneath Splunk — without touching a single workflow.
