Imply Lumi Observability Warehouse

Imply Data, Inc. was founded in 2015 by the original creators of Apache Druid and has its corporate office in San Francisco, with operations in North America, Europe and Asia Pacific. Besides the Druid-based real-time analytics services Imply Polaris and Imply Enterprise, the company launched Imply Lumi in September 2025 to tackle the rising cost of storing and searching security and observability logs.

Lumi acts as a data layer that sits alongside an existing SIEM rather than replacing it. It ingests logs through the agents and forwarders already in use, stores them in a compressed format and searches them in place in S3 or other data lakes, without rehydration, catalogs or predefined schemas. Analysts keep querying from Splunk in native SPL or SQL and from Grafana or Tableau. Case studies include BTG Pactual, Netflix, a large university and telecom carriers.

• SIEM-adjacent layer: Works beside Splunk and other SIEMs without replacing them.
• Native SPL and SQL: Analysts query with Splunk SPL or SQL from their usual tools.
• Lumi Loglake: Interactive log search directly on S3 and other object storage.
• Schema-free ingestion: Uses existing agents and forwarders with no catalogs or predefined schemas.
• Elastic query engine: Purpose-built compute for high concurrency and unpredictable workloads.
• Flexible deployment: Managed service plus Lumi Enterprise bring-your-own-cloud option.

A Vietnamese bank running Splunk can keep a year of security logs searchable in its data lake to meet audit requirements at lower cost. A telecom operator can investigate network incidents across months of logs without restoring archives. A managed security service provider can offer longer retention to clients without raising SIEM licence fees.

Security and operations teams can keep full-fidelity logs searchable for longer without paying SIEM ingestion prices; the vendor claims more than 70% savings and searches over 15x faster. Existing dashboards, detections and alerts are preserved, so there is no migration or retraining. Searching data directly in object storage removes the slow restore step for historical investigations.

Log volumes are growing faster than security and observability budgets, and AI-driven detection needs longer, complete data history. Enterprises are therefore separating log storage from SIEM licences and moving data to cheaper object storage. Banks, telecom operators and large enterprises in Southeast Asia face the same pressure as data retention rules tighten.

Founded in 2015 by the creators of Apache Druid; corporate office at 2261 Market St, San Francisco. Backed by Thoma Bravo, Andreessen Horowitz, Bessemer Venture Partners, Tiger Global, Khosla Ventures and Geodesic Capital. Partnered with Cribl in January 2026.