Why are some searches using a lot of memory?
Adding a notable index to the default indexes to be searched causes correlation searches to detect another finding again based on the content of a previous correlation search firing.
The solution is to remove the notable index from the list of indexes to be searched by default.
See Configure and deploy indexes in the Splunk App for PCI Compliance Installation and Configuration Manual for more information.
Learn more and get help
This documentation applies to the following versions of Splunk® App for PCI Compliance: 3.1.3, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.4.0, 3.4.1, 3.4.2, 3.5.0, 3.6.0, 3.6.1, 3.7.0, 3.7.1, 3.7.2, 3.8.0, 3.8.1, 4.0.0, 4.0.1, 4.1.0, 4.1.1, 4.3.0, 4.4.0, 4.4.1