Which index-time props.conf attributes impact indexing performance? (Select all that apply.)

Question

Options

• AREPORT
• BLINE_BREAKER
• CANNOTATE_PUNCT
• DSHOULD_LINEMERGE

Explanation

B (LINE_BREAKER), C (ANNOTATE_PUNCT), and D (SHOULD_LINEMERGE) are all index-time attributes that directly affect how Splunk processes data during ingestion, making them the correct selections. LINE_BREAKER defines the regex used to split raw data into events at index time - a complex pattern increases CPU overhead per event. SHOULD_LINEMERGE controls whether Splunk combines consecutive lines into multiline events, which requires additional processing and buffering during indexing; setting it to false when not needed improves throughput. ANNOTATE_PUNCT generates the punct field by extracting punctuation patterns from every event at index time - disabling it (ANNOTATE_PUNCT = false) is a well-known Splunk performance tuning step.

A (REPORT) is wrong because it is a search-time directive that references transform stanzas for field extraction - it does nothing during indexing and has zero impact on indexer throughput.

Memory tip: Think "index-time = data shape + overhead." LINE_BREAKER and SHOULD_LINEMERGE shape events; ANNOTATE_PUNCT adds overhead to every event. REPORT belongs to search, not storage - if it sounds like "reporting on data," it's probably search-time.

No community discussion yet for this question.