what are the best practices for using splunk, and how do you determine storage/sizing
I believe you are looking for this.
I also believe you will find this useful
in particular, there is information about storage/sizing here:
As well as Hardware capacity planning for your Splunk deployment.