https://docs.splunk.com/Documentation/Splunk/7.3.1/DistSearch/SHCarchitecture Scroll down to section titled, How the cluster handles concurrent search quotas, "Overall search quota. This quota determines the maximum number of historical searches (combined scheduled and ad hoc) that the cluster can run concurrently. This quota is configured with max_Searches_per_cpu and related settings in limits.conf."

While HEC has precautions in place to prevent data loss, it's impossible to completely prevent such an occurrence, especially in the event of a network failure or hardware crash. This is where indexer acknolwedgment comes in.

At search time, Splunk processes tags.conf across apps in reverse-lexicographical order, meaning apps with names later in the alphabet take precedence over earlier ones when resolving tag definitions.

The LINE_BREAKERsetting in props.confis used to define a regular expression that determines where Splunk should break the data into separate events. In this case, we want to break the events whenever a new <Interceptor>element is encountered. The regular expression ([\r\n]+)\s*<Interceptor>matches line breaks followed by the
<Interceptor>element, ensuring that each event starts with this element.
SHOULD_LINEMERGE = falseensures that Splunk does not merge the events based on line breaks, so each event is treated independently.