This article is quite helpful – https://www.aplura.com/splunk-best-practices/