Articles

Security teams often keep logs long after they have aged out of their SIEM platform’s searchable window. The data is there for investigations or audits, but accessing the data for insights can be complicated.

This week Anthropic launched Claude Dashboards in beta. You connect a data source, ask a question in plain language, and Claude writes the queries and builds the dashboard.

The Imply Lumi Lounge sat directly across the street from Splunk .conf26 and reached venue capacity on both days. Digital signs around the Colorado Convention Center pointed attendees our way with a simple message: “Federated search, done right. Full SPL. Less spend.”

Search unstructured logs in place in your data lake

A security team of four has run a major SIEM since February. Nobody on the team writes SPL. Nobody opens the console or looks at the dashboards. Every question goes through an AI agent, which writes the query, runs it, reads the result, and answers in plain language.

When a security incident happens, investigators almost always start with the same questions: Which systems communicated? Where did the traffic originate? What changed before the incident? Was data exfiltrated? AWS VPC Flow Logs are often the fastest way to answer those questions.

One copies data back before it can be searched. The other queries it where it lives. Lumi Loglake lets Splunk teams query logs directly in object storage, including AWS S3, Delta Lake, Apache Iceberg, using standard SPL.

Machine data architectures are rapidly changing. As telemetry volumes continue to grow and as costs rise, organizations are increasingly moving logs and other machine data into object stores such as AWS S3.

Teams are increasingly moving log data into AWS S3 to reduce costs and extend retention. Both Lumi Loglake and Splunk Federated Search to S3 help you query data in AWS S3 to lower costs, however the two technologies have several notable differences.

TL;DR: Imply Lumi Loglake is a lakehouse (separated compute/storage) architecture for unstructured logs that reduces costs from 40% up to orders of magnitude on your hardware/AWS/Azure bill used to run your SIEM/observability products.

We are getting ready to introduce the next major expansion of Imply Lumi and the observability warehouse. When we introduced the industry’s first observability warehouse, the goal was clear: decouple the observability stack by separating storage, compute, and access.

Observability has a silo problem. Today, we’re removing another one. Imply Lumi’s Grafana Loki integration is now in Private Preview.

Most security teams are forced to choose between cost, retention, and performance as data volumes grow. BTG Pactual broke that tradeoff by rethinking the data layer underneath Splunk — without touching a single workflow.

If you caught our recent product update, you’ve already seen the pace of development on Imply Lumi has been relentless.

Since releasing Imply Lumi in September 2025 as a decoupled data layer for observability, the Imply R&D team has been hard at work to make it easier and more economical to retain, query, and analyze observability data — without disrupting existing workflows

Before we take on 2026, let’s rewind. 2025 was the year observability teams stopped asking, “How do we reduce data?” and started asking the real question: “How do we build an architecture that can keep up?”

For years, observability has promised to give teams the visibility they need to keep digital services resilient. But as data volumes explode, many leaders are realizing the tools they rely on aren’t keeping up.

Splunk has long been the system of record for observability and security data. It’s powerful, battle-tested, and deeply embedded in how teams work. But today’s telemetry volumes have outgrown the index-first architectures most observability stacks rely on.

Logs are exploding. Costs are climbing. Performance is stalling. If you manage logs, you’re in the hot seat Every app, every integration, every security risk—it all generates more data. And when something breaks, everyone turns to you for answers. Fast.

Modern observability systems are hitting the same wall business intelligence did a decade ago. As data volumes explode, the traditional model — where a single product handles ingestion, storage, compute, and visualization — has become too costly, too rigid, and too closed.

After a few energizing days at CriblCon 2025, one message stood out everywhere I looked: teams don’t want to do less with their data — they want to do more. Cribl showed how to unlock that freedom at the pipeline. Imply Lumi extends it into the query layer.

I spent a few days in National Harbor, just outside Washington, D.C., for CriblCon 2025—and it was impossible not to feel the energy in the room.

As the volume of log data continues to rise, even great observability solutions force tough trade-offs: rising license fees, limited retention windows, and slow searches caused by archived data.

Splunk’s Snowflake partnership is the latest sign of federation’s rise. The pattern is clear: stop duplicating data, query it where it sits. That model works for business data, and with Imply Lumi it now extends to observability and security.

At .conf25, Splunk set the tone: digital resilience in the AI era. From AI-powered SOCs to agentic observability, the message was clear, resilience is about visibility, speed, and smarter response.

Every organization I talk to wants the same three things: keep more data, search it faster, and spend less doing it. The problem isn’t ambition — it’s architecture.

We’ve officially hit double digits! Ten years ago, a few Druid-obsessed engineers asked a radical question: What if analytics didn’t have to be slow, stale, or stuck in dashboards?

Observability is meant to provide clarity, speed, and confidence in modern systems. Yet for many organizations, it has become a source of complexity, cost, and operational drag.

Observability has evolved. Forward-looking teams are already moving beyond static dashboards and fragmented telemetry—treating all observability data as events and unlocking real-time insights across their stacks.

Real-time analytics is a game-changer for businesses that need to make fast, data-driven decisions. Whether you’re analyzing user activity, monitoring applications and infrastructure, detecting fraud, or keeping a pulse on operational metrics, getting insights in the moment matters.

Apache Druid® is an open-source distributed database designed for real-time analytics at scale. We are excited to announce the release of Apache Druid 32.0. This release contains over 341 commits from 52 contributors. It’s exciting to see a 30% increase in our contributors!

At the inaugural in-person Druid Summit this past October, industry leaders gathered to explore the future of data, streaming analytics, and more.

Apache Druid® is an open-source distributed database designed for real-time analytics at scale. Since our founding ten years ago, Imply has been committed to growing the Apache Druid project by making it as easy as possible for people to use Druid and build awesome data applications on top of it.