Knowledge Management

Forward index or inverted index- Which model does Splunk use?

New Member

I've been reading about the differences between forward indexes and inverted indexes.  Which model does Splunk use?  I have not been able to find that information in the documentation.

Labels (2)
0 Karma


Hi @aznewman ,

Splunk uses a time series inverted index, in the form of .tsidx files:

You can read more about how that index is built/populated here:


0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...