SPLK-2002: Splunk Enterprise Certified ArchitectDemo

LINE_BREAKER and SHOULD_LINEMERGE determine how incoming data is split and merged into events; direct line breaking is more efficient than line merging. ANNOTATE_PUNCT controls creation of an additional punct:: token in the index, which adds indexing work and can increase index space. REPORT is for search-time field extraction rather than index-time processing.