Getting Data In

How can I increase how far back users can see data in splunk?

New Member

When I run a search for "All Time" it looks to stop displaying data beyond 90 days into the past. Where's the config file(s) I need to change to increase how far back users can view indexed data?

Tags (1)
0 Karma


I believe the data available in your index that you're search is only 90 days. This is set by the retention period policy that you/your Splunk admin has applied. See below link on how the data retention policy is applied on Splunk. Based on this, setup appropriate data retention policy