Closing this box indicates that you accept our Cookie Policy.
noun
A data structure that you use to test whether an element is a member of a set. Splunk Enterprise uses Bloom filters to decrease the time it requires to retrieve events from the index. This strategy is effective when you search for rare terms.
In Splunk Enterprise, Bloom filters work at the index bucket level. The filters rule out buckets that do not contain keywords from the search being run. Splunk Enterprise saves time searching by focusing on the tsidx files within the bucket where the search keywords exist.
By default, Splunk Enterprise uses Bloom filters when you run a search that involves warm buckets. They do not exist for hot buckets and are deleted when warm bucket data rolls to frozen. You can configure the details of the filter's operation, including their retention behavior, in limits.conf. You can also use indexes.conf to manually create a Bloom filter for a specific index.