Splunk .conf25 Recap: Imply Lumi’s Big Debut in the Partnerverse
At .conf25, Splunk set the tone: digital resilience in the AI era.
From AI-powered SOCs to agentic observability, the message was clear, resilience is about visibility, speed, and smarter response.
But resilience truly starts with the data. If dashboards or AI can’t reach it—because it’s archived, siloed, or too expensive to keep hot, resilience falls apart.
That’s the gap Imply Lumi, the industry’s first Observability Warehouse, was built to fill.
And in Boston, we announced Imply Lumi to the Splunk world for the very first time!
Observability at a Breaking Point
Walking the floor and talking with observability admins in attendance, we heard their challenges loud and clear:
- Costs are spiraling as data volumes explode
- Teams juggle a patchwork of observability tools
- Slow searches when data is spread across hot and archived tiers, especially during investigations
If this sounds familiar, it should. Business Intelligence went through the same shift: data outgrew monolithic stacks, and the real innovation came from decoupling storage from compute.
Observability is now at that same breaking point.
Stronger Together: Imply in the Splunk Partnerverse
We came to Boston as part of the Splunk Partnerverse, showing how Imply Lumi — the industry’s first Observability Warehouse — makes Splunk even more powerful while reducing costs.
Splunk remains the command center: the dashboards, alerts, and workflows your teams already know and trust. But underneath, Imply Lumi becomes the engine — a high-performance, cost-efficient warehouse that keeps more logs, metrics, and traces hot and instantly searchable.
The result? Splunk admins gain the freedom to do more:
- Keep more data online without ballooning storage costs
- Run queries at speed with sub-second performance
- Unlock deeper insights for AI/ML and automation
- Expand use cases — all within the same familiar Splunk workflows
This vision builds on what Splunk has already signaled with Federated Search: the ability to analyze data without moving it.
Imply Lumi takes that vision further — decoupling source, storage/compute, and interactive layers — and brings the performance, scale, and economics of a modern warehouse to every Splunk deployment.
With Splunk and Imply Lumi, enterprises can store more, search faster, and stop choosing between cost and visibility.
Imply at Splunk .conf25: Extending the Power of Splunk with Imply Lumi
Admins who joined us at Splunk .conf25 didn’t just hear about Imply Lumi — they experienced it in action, working seamlessly alongside Splunk.
In our breakout sessions — “Say Yes to More Data: Extend Your Splunk Investment” and “Unlock More Use Cases Without Breaking the Bank” — we showed how Imply Lumi helps Splunk admins keep more data searchable, extend Splunk into new workloads, and support more teams without breaking budgets.
At the booth, those ideas came to life. Visitors watched their Splunk dashboards load in seconds, even across months of historical data. They saw storage footprints shrink by more than 50% without losing fidelity. They discovered that AI/ML workflows — from ChatGPT to Claude to LangChain — could query Lumi directly. And they saw Splunk side by side with Grafana, Tableau, and other tools, all powered by the same Imply Lumi data layer.
The outcome was clear: admins walked away with more freedom to say yes — yes to more data, yes to more use cases, and yes to delivering a bigger impact across their organizations.
“I’ve been told this is the most exciting product in the room, so I stopped by.” — Splunk .conf attendee
We’ll be back
Our first Splunk .conf wasn’t just a debut — it was a new chapter for Splunk customers: more resilience, more reach, and more room to grow with Imply Lumi.
Book an Imply Lumi demo
Read the Imply Lumi announcement
And this is just the beginning. Next year, when .conf26 lands in Denver, we’ll be back with bigger stories, faster demos, and more ways for Splunk admins to unlock the full potential of their data.
With Imply Lumi, Splunk admins have the freedom to do more.
Related articles
More from Imply on the same topic.
Search your Splunk DDSS archive without restoring it
Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.
Claude makes dashboards now, Lumi is ready for them
This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.
Lumi Lounge Recap: 3 Takeaways from Splunk .conf26
The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”
Agents don’t query like your detections do
A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.
Why You Shouldn’t Have to Delete Your VPC Flow Logs
When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.
Splunk Smartstore vs Lumi Loglake: Two Very Different Ways to Search Logs in Object Storage
One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.
Supercharging Schema-On-Read: Logs in Object Storage Don’t Need a Data Catalog
Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.
Imply Lumi Loglake vs Splunk Federated Search for S3
Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.
A First Look at Lumi Loglake: Query Logs Where They Live
TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.
Imply Lumi Major Release Preview: Continuing the Journey Towards Decoupled Observability/SIEM
We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse. When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access.
Query Lumi from Grafana: Now in Private Preview
Observability has a silo problem. Today, we’re removing another one. Imply Lumi’s Grafana Loki integration is now in Private Preview.
