FAQ
Why are some searches using a lot of memory?
Adding a notable index to the default indexes to be searched causes correlation searches to detect another finding again based on the content of a previous correlation search firing.
The solution is to remove the notable index from the list of indexes to be searched by default.
See Configure and deploy indexes in the Splunk App for PCI Compliance Installation and Configuration Manual for more information.
Last modified on 14 February, 2022
| Search macros | Learn more and get help |
This documentation applies to the following versions of Splunk® App for PCI Compliance: 5.0.1, 5.0.2, 5.1.0, 5.1.1, 5.1.2, 5.2.0, 5.3.0, 5.3.1, 5.3.2
Download manual
Feedback submitted, thanks!