Getting Data In

Is setting up bloom filters still recommended in Splunk 6.2.3?



Is setting up Bloom Filters still recommended under 6.23? I am hearing conflicting statements about if they should still be setup and if they actually drive value.

Tags (2)

Splunk Employee
Splunk Employee

It depends on what kind of searches you are doing. Bloom filters are most effective at improving performance for rare term searches. Can you say more about what your use cases are, and maybe provide some sample data and searches? That will help the community answer your question better. It's not a simple yes/no on/off question.

Here is the documentation topic, if you have not already seen it.

There has been no change to bloom filters in Splunk Enterprise 6.2.3.


Is there any good reason to turn them off?

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...