File upload reference

To quickly get started with Imply Lumi, you can upload log files.

This topic provides describes the requirements for files you plan to upload to Imply Lumi.

Prerequisites

To upload files and search events, you need the Data manager role or higher. For more information on roles and permissions, see Manage roles.

Supported file formats

Imply Lumi supports CSV files exported from Splunk®.

For information about exporting data from Splunk, see Export data using Splunk Web.

File size limit

Imply Lumi supports a maximum file size of 200 MB. This limit refers to the size of the file transmitted by the browser or HTTP client.

Attributes

Events ingested from a file upload contain system attributes and user attributes.

Configurable attributes

When uploading a file, you can define the following attributes:

• System attributes
  • Environment
  • Team
• User attributes
  • Source
  • Source type
  • Index

The configurable attributes are unset by default. Imply Lumi enriches events with these attributes in the following order:

1. For user attributes, assign the attributes defined in the file.
2. Otherwise, apply the attributes configured in the Imply Lumi UI.
3. If no attribute values are set, don't enrich the event with any of these attributes.

For descriptions of the event attributes, see Event model.

System attributes

The following system attributes apply to events added by file upload:

• eventId: ID of the event.
• observedAt: Time the file uploaded. Events in the same file have the same observedAt timestamps.
• receiver: Always imply.file.
• iamKeyId: ID of the user who completed the upload.
• status: Determined from the event iteslf.
• file: Name of the uploaded file.

Use the file system attribute to explore events only pertaining to the file. For example, to only view events from a specific file, filter your searches with the condition #file=lumina_visitors.csv and the appropriate time range.

If you specified the environment or team attributes in the Imply Lumi UI, events will also contain the env and team attributes respectively.

User attributes

When you upload a file from Splunk to Imply Lumi, Imply Lumi preserves the Splunk fields as user attributes.

If you specified source, source type, or index in the Imply Lumi UI, Imply Lumi assigns them as user attributes. If the original event already specifies those attributes, Imply Lumi retains the values from the original events.

Learn more

For more information on system and user attributes, see Event model.