Hi @shrutheen, The question is: I suppose that you have an Indexer Cluster, so why have you RF=1? Anyway, I think that having 800 GB with RF=1 and SF=1 you shouldn't have 2400 GB with RF=3 and SR=2 because the tsindexes (SF) take around the 35% of the space required, so you should have for 100GB/day: total row data = 100GB * 15% * RF = 45GB tsindexes data = 100GB * 35% * SF = 70GB total storage = 115GB peer storage =total / 3 = 38.3GB So what's the daily indexed logs of your infrastructure? For this job is usually requested  at least a Splunk Architect, this isn't a job for the Community. Ciao. Giuseppe ... View more

The below is from Ovie in the Splunk community Slack channel #enterprise-security: Not sure if it is your issue but it is supposed to be related to duplicates like that. So it might apply to some of you. This can happen because of phased_execution_mode https://docs.splunk.com/Documentation/ES/5.2.0/RN/KnownIssues 2019-04-08 SOLNESS-18603 Incident Review: eventCount does not match resultCount causing display issues (such as events being displayed twice) Workaround: Set phased_execution_mode to singlethreaded For: limits.conf [search] phased_execution_mode = singlethreaded https://docs.splunk.com/Documentation/ES/5.1.0/Install/DeploymentPlanning#Splunk_Enterprise_system_requirements Splunk Enterprise Security 5.1 is compatible with Splunk Enterprise 7.1.0 and 7.1.1 only by setting phased_execution_mode=singlethreaded in the [search] stanza of the $SPLUNK_HOME/etc/system/local/limits.conf file to avoid an issue that is fixed in Splunk Enterprise 7.1.2. However, if you apply this workaround for 7.1.0 and 7.1.1 and then upgrade Splunk Enterprise but remain on ES 5.1, then you need to set it back to phased_execution_mode=multithreaded. Splunk Enterprise Security 5.2.x is compatible with Splunk Enterprise 7.1.0 and 7.1.1 only by setting phased_execution_mode=singlethreaded in the [search] stanza of the $SPLUNK_HOME/etc/system/local/limits.conf file to avoid an issue that is fixed in Splunk Enterprise 7.1.2. Bottom line is this setting has caused some serious grief. ... View more