if you think you have enough memory then the issue could be with search you are running. there could be chance of improving search performance as well.
Hi @wahluf,
You are correct that you need to add RAM to your Splunk Searchhead to improve your search capabilities and performance.
See here: Searches are auto-cancelled
Do you happen to know if your Searchhead is a physical server or a virtual machine?
We do hope this helps you out with your question!
V/R,
nwuest