Closing this box indicates that you accept our Cookie Policy.
noun
A data structure that you use to test whether an element is a member of a set. The Splunk platform uses Bloom filters to decrease the time it requires to retrieve events from the index. This strategy is effective when you search for rare terms.
On the Splunk platform, Bloom filters work at the index bucket level. When a search runs, the filters immediately rule out buckets that do not contain keywords for that search, avoiding the need to search their tsidx files.
An indexer creates Bloom filters when its buckets roll to warm. It uses the Bloom filters when searching warm or cold buckets. Bloom filters do not exist for hot buckets and are deleted when buckets roll to frozen. You can configure details of Bloom filter operation in the indexes.conf and limits.conf files.