Splunk expands federation, Imply Lumi extends it to observability
Splunk’s Snowflake partnership is the latest sign of federation’s rise. The pattern is clear: stop duplicating data, query it where it sits. That model works for business data, and with Imply Lumi it now extends to observability and security.
At this year’s Splunk .conf, Splunk announced a new capability: federated search with Snowflake.
At first glance, it might sound like a breakthrough. But federation — the ability to query data where it lives without duplicating it — has been a core part of analytics for years. Platforms like Snowflake, BigQuery, and Redshift all support it, and BI tools like Tableau and Looker federate data across systems into a single view.
What’s notable here is Splunk putting federation at the center of its own story. By spotlighting Snowflake, Splunk is acknowledging what customers have said all along: they’re tired of duplicating data and paying ingest fees just to search it. They want to query data where it already sits.
That principle should sound familiar if you stopped by our booth at .conf, where we launched Imply Lumi — the industry’s first Observability Warehouse, built on true decoupling.
Federation: An Arc, Not a One-off
Splunk’s Snowflake announcement is the latest chapter in a broader federation journey:
- AWS S3 Federation → early moves to let customers query security data in S3 without pulling everything into Splunk.
- Security Data Lake integrations → enabling federated search across external security stores.
- Now Snowflake → extending federation into the business data warehouse, enriching operational insights with financial, customer, and supply chain context.
The throughline is clear: Splunk knows customers don’t want to duplicate data. They want to access it where it already lives.
This arc reinforces our point: federation is the future. And while Splunk is extending it to business and security data, Imply Lumi applies the same principle to observability data — the hardest, highest-velocity workloads of all.
Industry Validation
The Splunk-Snowflake announcement validates what we’ve said from day one: silos must go. As Splunk SVP Kamal Hathi put it:
“Splunk Federated Search for Snowflake makes it simple for customers to access and act on their data, uniting business and operational insights in one view.”
Snowflake reinforced the point:
“This makes it easier for organizations to harness business and operational data, enabling insights to flow to where they are needed most to power data insights and AI innovation at scale.” — Carl Perry, Head of Analytics, Snowflake
We couldn’t agree more. Federation is the future. The only question is: which data, for which purpose?
Different Use Cases, Different Goals
Splunk’s Snowflake federation is designed for business data — transactions, customer records, supply chain metrics. It enriches Splunk queries with business context.
Imply Lumi, by contrast, is designed for security and observability data — logs, metrics, and traces that are massive, messy, and ingested at high-speed. That’s the data that drives MTTR, troubleshooting, and operational visibility.
In short: different data, different workloads, different goals.
How Imply Lumi goes further
Where Splunk + Snowflake helps enrich business data, Imply Lumi is built for the unique demands of observability. That means:
- Store more, spend less → extend retention windows, affordably
- Faster queries → subsecond performance on high-cardinality, high-volume workloads
- Broad ecosystem support → works with Splunk, Grafana, Cribl, Tableau, and more
- Zero workflow changes → keep your dashboards, alerts, and processes exactly the same
Bottom Line
Splunk’s announcement doesn’t reinvent federation — but it does validate it. That’s good for customers, good for the ecosystem, and proof of the approach we pioneered with Imply Lumi.
There’s also fine print:
“For Splunk Cloud AWS commercial customers, Splunk Federated Search for Snowflake will become generally available globally in July 2026.”
In other words, this capability is narrowly scoped today and won’t be broadly available for almost a year. For customers who want federation now — especially for observability — Imply Lumi is ready today.
Why wait? If you stopped by our booth at .conf, you already saw it: true decoupling, available now, with cost-efficient storage, faster queries, and seamless compatibility with the tools you already use.
Related articles
More from Imply on the same topic.
Search your Splunk DDSS archive without restoring it
Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.
Claude makes dashboards now, Lumi is ready for them
This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.
Lumi Lounge Recap: 3 Takeaways from Splunk .conf26
The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.
Why You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.
Splunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.
Supercharging Schema-On-Read: Logs in Object Storage Don’t Need a Data Catalog
Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.
Imply Lumi Loglake vs Splunk Federated Search for S3
Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.
A First Look at Lumi Loglake: Query Logs Where They Live
TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.
Imply Lumi Major Release Preview: Continuing the Journey Towards Decoupled Observability/SIEM
We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse. When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access.
Query Lumi from Grafana: Now in Private Preview
Observability has a silo problem. Today, we’re removing another one. Imply Lumi’s Grafana Loki integration is now in Private Preview.
