Splunk Search

How do I configure the retention period for users' search history?

rmacurak
Explorer

How do I configure the retention period for users' search history?

0 Karma
1 Solution

lguinn2
Legend

Create a $SPLUNK_HOME/etc/system/local/limits.conf file if it does not already exist.
In limits.conf

[search]
max_history_length = 2000

This is from the documentation:

max_history_length = <int>
* Max number of searches to store in history (per user/app)
* Defaults to 1000

View solution in original post

lguinn2
Legend

Create a $SPLUNK_HOME/etc/system/local/limits.conf file if it does not already exist.
In limits.conf

[search]
max_history_length = 2000

This is from the documentation:

max_history_length = <int>
* Max number of searches to store in history (per user/app)
* Defaults to 1000

View solution in original post

somesoni2
Revered Legend

The | history command reads content of folder $Splunk_home/etc/users/UserName/AppName/history/SHName.csv file and the data is not indexed. Not sure if a retention applies there.

0 Karma

rmacurak
Explorer

Indeed. It seems only the most recent 1000 searches are stored. I'm interested in increasing the retention. Any ideas what controls that retention limit?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!