Which configuration item should be set to false to significantly improve data ingestion performance?

The SHOULDLINEMERGE setting in props.conf dictates whether Splunk should attempt to combine multiple lines of incoming data into a single event. This process, known as event aggregation, is one of the most resource-intensive parts of the data ingestion pipeline. When SHOULDLINEMERGE is true, Splunk must buffer data and apply pattern matching to identify event boundaries, which consumes significant CPU and memory. By setting SHOULDLINEMERGE = false for data sources that are known to be single-line events, this entire aggregation process is skipped. Each line is treated as a separate event, which dramatically reduces processing load and significantly improves ingestion performance.

A. AUTOKVJSON: Disabling this improves performance for JSON data by skipping index-time field extraction, but its impact is less universal and generally not as significant as disabling line merging.

B. BREAKONLYBEFOREDATE: This setting is an optimization used only when SHOULDLINEMERGE is already true. It helps the line-merging process but does not disable it.

D. ANNOTATEPUNCT: This affects the tokenization process during indexing. Disabling it can reduce index size and slightly improve indexing speed, but its performance impact is less than that of the event processing and aggregation pipeline.

---

1. Splunk Enterprise Documentation, props.conf specification:

Section: [], Parameter: SHOULDLINEMERGE

Content: The documentation explicitly states, "For single-line events, you can improve performance by setting SHOULDLINEMERGE = false." This directly links the setting to performance improvement by simplifying the event processing path.

2. Splunk Enterprise Documentation, Getting Data In Manual:

Section: "Configure event line breaking"

Content: This section details how line breaking is a critical and resource-intensive part of data input configuration. It advises that for optimal performance, SHOULDLINEMERGE should be set to false for any source type that does not contain multi-line events, as this avoids the overhead of the aggregation processor.

3. Splunk Enterprise Documentation, Troubleshooting Manual:

Section: "Indicators of performance issues"

Content: Performance issues are often traced back to blocked processing queues, such as the aggQueue (aggregation queue). The primary cause of a blocked aggQueue is inefficient or complex line-breaking configurations, reinforcing that SHOULDLINEMERGE is a critical performance tuning parameter.