September 2026 Summaries

At Splunk .conf26, Imply’s Lumi Lounge highlighted growing concern among security teams about the cost and scalability of centralizing ever-larger volumes of log data in a SIEM, alongside interest in retaining established Splunk workflows. Imply positioned its newly available Lumi Loglake as a federated-search approach that lets users query data stored in Amazon S3 with standard SPL and return native Splunk events without first moving, cataloging, or rehydrating the data, contrasting it with Splunk’s Machine Data Lake workflow. Customer BTG Pactual reported using a hybrid Splunk and Lumi architecture to extend searchable retention from 90 days to one year, add more than 45 data sources, support over 15 business units, process 17 additional terabytes daily, and reduce security-data costs by more than 70%. The discussion also emphasized that agentic security operations depend on affordable, searchable access to long-term historical data, since AI agents may conduct unpredictable, multi-step investigations that require context unavailable in short retention windows.

Imply has announced the general availability of Lumi Loglake, a capability for querying unstructured logs directly within data lakes using SPL and SQL without requiring prior indexing, rehydration, schema management, catalogs, or data pipelines. Supporting storage platforms such as Amazon S3, Google Cloud Storage, and Azure Cloud Storage, as well as formats including text, Parquet, JSON, and GZIP, Loglake applies schema at query time to accommodate changing log formats and investigative needs. Splunk users can search both indexed and object-storage data with standard SPL while retaining compatibility with existing dashboards, alerts, detections, Splunk Enterprise Security, and Splunk SOAR. Separate on-demand compute pools are intended to prevent historical investigations and AI workloads from affecting real-time monitoring, allowing organizations to retain more telemetry in lower-cost object storage while continuing to use established analysis tools.

The post argues that AI agents are changing security information and event management workloads by generating large volumes of unpredictable, chained queries that differ from the fixed, scheduled searches for which many SIEM platforms were optimized. It contends that long retention periods, inaccessible archived data, slow searches, finite AI context windows, and always-on compute costs can cause agents to return incomplete conclusions or make broad investigations expensive. The author contrasts Splunk approaches such as SmartStore and federated S3 search with Imply Lumi, a product built on Apache Druid, claiming that its concurrent-query architecture, schema discovery, indexed storage, elastic compute pools, and support for SPL and SQL better suit agent-driven investigations. The post also says Lumi can preserve existing Splunk consoles, searches, and dashboards while lowering storage and search costs, citing BTG Pactual as an example, and concludes that organizations should prioritize response time across their complete retention window rather than only their hot data tier.