How are you tuning ES to your environment?
Are you overwriting the correlation searches that ship with ES or are you making copies of them and modifying the copies?
When there is an update for ES, are you having to go correlation search by correlation search, line by line to comparing them to see what changed?
What about ES Content Updates?
tuning an ES environment isn't a job to ask in Community but it requires Splunk Professional Services or at least a Training on ES Administration!
Anyway, the most important tuning is to see if there are problems on resources when Scheduled Searches are executed; then you have to see if there are queues in Indexing.
You can check all using the Splunk Monitoring Console.
About the other questions: