Bloom Filters

A **Bloom Filter** is a probabilistic data structure that Splunk uses to quickly determine if a specific term exists within an index bucket.

Before reading any raw data, the indexer checks the bloom filter. If the term is NOT in the bloom filter, Splunk skips that entire bucket — saving massive I/O.

This is why using specific, rare terms in your base search is critical for performance.