To determine duplicate data, you could do a | stats count by _raw, _time, host, source although I promise that will be a slow and painful process.
Indexed data volume is captured in index=_internal source=*/license_usage.log sourcetype=splunkd and then you can specify a sourcetype using the st= field.
Where do you think you have duplication? Starting with the symptoms that motivated your question will help us be more surgical in what would otherwise be a very involved process.
