topic Re: forward index or inverted index in Knowledge Management

Forward index or inverted index- Which model does Splunk use?

aznewman — Mon, 26 Sep 2022 15:24:21 GMT

I've been reading about the differences between forward indexes and inverted indexes. Which model does Splunk use? I have not been able to find that information in the documentation.

Re: forward index or inverted index

chaker — Mon, 26 Sep 2022 06:26:15 GMT

Hi @aznewman ,

Splunk uses a time series inverted index, in the form of .tsidx files:

https://docs.splunk.com/Splexicon:Tsidxfile

You can read more about how that index is built/populated here:

https://docs.splunk.com/Documentation/Splunk/9.0.1/Data/Abouteventsegmentation