QuestionQ89

Filtering and Formatting Results

Which of these statements is correct about bloom filters?

  • A Hot buckets have no bloom filters as their contents are always changing.
  • B Bloom filters could return false positives or false negatives.
  • C Each bucket uses a unique hashing algorithm to create its bloom filter.
  • D The bloom filter contains trinary values: 0, 1, and 2.
Explanation

In Splunk, hot buckets have no bloom filters because they are actively being written to. Bloom filters are binary probabilistic structures that can indicate a possible match falsely, but they do not produce false negatives. Splunk’s support documentation explicitly notes that hot buckets have no bloomfilters.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!