topic How do I configure the retention period for users' search history? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200272#M58042 <P>How do I configure the retention period for users' search history?</P> Wed, 13 Apr 2016 15:42:14 GMT rmacurak 2016-04-13T15:42:14Z How do I configure the retention period for users' search history? https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200272#M58042 <P>How do I configure the retention period for users' search history?</P> Wed, 13 Apr 2016 15:42:14 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200272#M58042 rmacurak 2016-04-13T15:42:14Z Re: How do I configure the retention period for users' search history? https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200273#M58043 <P>The | history command reads content of folder $Splunk_home/etc/users/UserName/AppName/history/SHName.csv file and the data is not indexed. Not sure if a retention applies there. </P> Wed, 13 Apr 2016 16:45:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200273#M58043 somesoni2 2016-04-13T16:45:02Z Re: How do I configure the retention period for users' search history? https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200274#M58044 <P>Indeed. It seems only the most recent 1000 searches are stored. I'm interested in increasing the retention. Any ideas what controls that retention limit?</P> Wed, 13 Apr 2016 16:57:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200274#M58044 rmacurak 2016-04-13T16:57:27Z Re: How do I configure the retention period for users' search history? https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200275#M58045 <P>Create a $SPLUNK_HOME/etc/system/local/limits.conf file if it does not already exist.<BR /> In limits.conf</P> <PRE><CODE>[search] max_history_length = 2000 </CODE></PRE> <P>This is from the documentation:</P> <PRE><CODE>max_history_length = &lt;int&gt; * Max number of searches to store in history (per user/app) * Defaults to 1000 </CODE></PRE> Wed, 13 Apr 2016 17:33:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-configure-the-retention-period-for-users-search-history/m-p/200275#M58045 lguinn2 2016-04-13T17:33:42Z