...when your Splunk setup explodes from memory exhaustion on a schedule, adding memory doesn't help, and then you find this in the release notes of one of the installed Splunk apps:
Fixed issues for Splunk App for NetApp Data ONTAP
Publication date Defect number Description
2016-10-12 NETAPP-730 NetApp App consuming all RAM on Indexer.
...yeah, the version currently installed is older than that. Also it's one of the few apps where updates mean quite some work. I sense a connection there.