Chart memory used by each SID (search ID) using the Introspection logs

index="_introspection"  "data.process"=splunkd | timechart max(data.mem_used) by data.search_props.sid usenull=f useother=f