Where does the bloomfilter reside?
Where does the bloomfilter reside?
The bloomfilter in Splunk resides in the index bucket folders, specifically under the path resembling $SPLUNK_HOME/var/lib/splunk/indexfoo/db/db_<timestamp>_<timestamp>_<id>. This corresponds to option A. The fishbucket directory (option C) is used to track the current position of indexed files and does not store bloomfilter data.
correct answer is A
Should be A. The bloomfilter file and tsidx files resifes on index bucket level. https://conf.splunk.com/files/2017/slides/revealing-the-magic-the-life-cycle-of-a-splunk-search.pdf
Fish bucket doesn’t deal with indexed data, only the heads/tails of monitored files. Bloom filter data resides in the bucket folders
A is correct
Yes A is correct