B

A search on which you can base multiple, similar searches.

Related Products: Platform

A filtering rule that excludes one or more members from a set. For example, you can use deny list rules to tell a forwarder which files not to consume when monitoring directories, or you can use a deny list rule with the deployment server to filter out a certain deployment client . You can combine deny list rules with allow list rules, which tell the Splunk platform which members of a set to allow in order to achieve precise filtering. Deny list rules override allow list rules. The term "deny list" replaces the term "blacklist", which is no longer in use. Both terms refer to the same functionality.

Related Products: Platform

A data structure that you use to test whether an element is a member of a set. The Splunk platform uses Bloom filters to decrease the time it requires to retrieve events from the index. This strategy is effective when you search for rare terms. On the Splunk platform, Bloom filters work at the index bucket level. When a search runs, the filters immediately rule out buckets that do not contain keywords for that search, avoiding the need to search their tsidx files . An indexer creates Bloom filters when its buckets roll to warm. It uses the Bloom filters when searching warm or cold buckets. Bloom filters do not exist for hot buckets and are deleted when buckets roll to frozen. You can configure details of Bloom filter operation in the indexes.conf and limits.conf files.

Related Products: Platform

A file system directory containing a portion of a Splunk Enterprise index . A Splunk Enterprise index typically consists of many buckets, organized by age. Note: The bucket search command is not related to the index buckets described here. Its purpose is to put continuous numerical values into discrete sets or bins. The bucket command is actually an alias for the bin command. See the bin command in the Search Reference .

Related Products: Platform

Related Terms: bucket fixing

In an indexer cluster , bucket fixing, or "bucket fixup," is the remedial activity that occurs when a peer node goes offline. The manager node orchestrates the remaining peers in a series of activities, such as replicating buckets and indexing non-searchable bucket copies, with the goal of returning the cluster to a valid and complete state. Bucket fixing can also occur in a few other circumstances, such as during data rebalancing.

Related Products: Platform

A tool which dynamically creates event types based on the analysis of a selected event . To access it, run a search, locate an event in the search results that might make a good event type, and select Build event type from the event menu. The Build Event Types utility lets you try out different field/value pairings for the event type search, test potentially useful event types, and save the event types that perform well.

Related Products: Platform

Related Terms: event type builder