I reached out to Splunk Engineering (via Support) to confirm this on RHEL7 and Splunk 6.5, and received the following:
Support confirms that "...it is still REQUIRED practice, not simply best practice that THP be disabled."
Here are Engineering's comments regarding the comment from "oschnar":
"His chart is inconclusive. THP doesn't affect/improve indexing rate as much as it severely affects search performance negatively. At low volumes, it doesn't matter, but at higher rates, you'll notice the effect, especially under high search loads/pressure.
AFAIK, the severe performance bug was fixed in later Linux kernels (circa kernel 4.x+, but not back-ported to rhel/centos 7.2) so that madvise is the default, and is reasonably safe to use. However, if the box is performing double duty, cycles will be spent to manage and defrag any use of THP outside of the Splunk process. Since we require dedicated ownership/use of the system, enabling THP for "alien" processes is not recommended.
I had recently confirmed with engineering that we do NOT use THP, but rather we directly allocate/manage hugepages (not the same feature), so disabling THP will be appropriate for any systems running a heavy Splunk process (such as search heads, cluster masters, indexers)."
... View more