What you are doing is good enough - there are some minor optimisations you can do to use a base search for all 3 panels, e.g. the base search and searches for the 3 panels could look like this <search id="base_tstats"> <query> | tstats count where index=* by index _time span=1d </query> </search> <search base="base_tstats"> <query> | stats sum(count) as events by index | where events=0 </query> </search> <search base="base_tstats"> <query> | stats sum(count) as events by index | where events>0 </query> </search> <search base="base_tstats"> <query> | stats count as days latest(_time) as _time by index | where days=1 AND _time=relative_time(now(),"@d") </query> </search> One way to check for manual index creation is to look in the audit log, but I'm not sure what happens when you edit indexes.conf and restart or what happens in a clustered environment, but you could check that if you really need to know about true creations as opposed to assumed creations.   index=_audit operation=create action=indexes_edit   Audit: [ timestamp=03-30-2021 21:11:42.415 , user=userrname , action=indexes_edit , info=granted object= "index_name " operation=create ][ n/a]   ... View more

No, that question cannot be answered without information on what types of data you want to collect and process. I don't recall ever seeing much detailed information on processing capacity of HFs, but if you can find specs for an indexer, you can assume a HF can do more, since HF does the same except it doesn't have to write to disk and does not have to deal with searches. How many EPS are equivalent to 200GB/day depends on event size of course, but with for instance an average event size of 1KB, it results in ~2400 EPS or so. But again: a single/few very beefy box(es) like you're asking for probably doesn't make much sense for a Heavy Forwarder layer in between your data sources and Splunk Cloud. From a data distribution point of view, you typically want at least as many forwarders as you have indexers, preferably more (can also be accomplished by enabling additional pipelines on forwarders). You may want to check with your Splunk Sales / PS rep for the latest guidelines on that and an assessment on what would best fit your environment. ... View more