DUO Log Add-on for Splunk: Where to change number of days of historical data after initial config?

[SamAlo]

We configured the DUO Log Add-on for Splunk to pull logs for the last 30 days and everything is working. We would now like to change it to pull logs from the last 90 days. Where can we make this change?

[bawood]

I'm not recommending doing this, but if you really need to you can change the history setting, then you would need to remove the checkpoint files under $SPLUNK_HOME/var/lib/splunk/modinputs/duo/

WARNING: doing so will double index the previous data.
If you don't want duplicate data you would need to clear or delete the index or change the input to index in a different one.