Hi @aldo  This is a slightly tricky one because the documentation is so light on the subject! However my take on this is that, yes, you should be okay to increase the heap size across the deployment for this service *however* what we dont know is how the other services will behave once this service is back up and running. e.g. just because there is 30gb RAM available now, when everything starts working properly and other services start working together the RAM Usage could increase (if that makes sense). I'd be tempted to increase is gradually until you see the issue resolve and then closely monitor the usage moving forwards. I dont know if you've seen https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/administer/5.4.1/monitor-splunk-uba/monitor-the-health-of-your-splunk-uba-deployment but there is some good info here on monitoring your UBA deployment so that might help once things have stabilised. 🌟 Did this answer help you? If so, please consider: Adding karma to show it was useful Marking it as the solution if it resolved your issue Commenting if you need any clarification Your feedback encourages the volunteers in this community to continue contributing ... View more