With specific regards to AWS, your optimum configuration for availability is to have a site replica origin RF to match the AZ count.
(or as many AZs as you are using). This means your storage volume is AZ's x data, but it also means you can sustain a failure in at least 1 AZ if not more, with out loosing replica copies.
Your search factor will depend on where you users are searching from, and how critical is search in the immediate aftermath of AZ failure?
If Splunk is critical to you (of course it is) and you NEED Splunk searching immediately - you should set the SF to match the RF - i.e every Splunk instance has a full searchable copy.
With Multi-Site clusters - you can dictate that a remote site has a full searchable copy of the data - if I were to assume this other site was in a different region, keeping a full replica copy (or more than 1) would give you immediate search from a surviving region into the environment affected with whatever surviving Splunk infrastructure you have.
So, the answer really is it depends. If you have the space, and resource the higher your RF and SF the better - Multi site clusters allow you to par this down in remote sites for cost optimisation purposes, or to bring searchable copies 'closer' to where users are likely to be using the data.
If my comment helps, please give it a thumbs up!
