How do I configure the retention period for users' search history?

[rmacurak]

How do I configure the retention period for users' search history?

[lguinn2 · Accepted solution]

Create a $SPLUNK_HOME/etc/system/local/limits.conf file if it does not already exist.
In limits.conf

[search]
max_history_length = 2000

This is from the documentation:

max_history_length = <int>
* Max number of searches to store in history (per user/app)
* Defaults to 1000

[somesoni2]

The | history command reads content of folder $Splunk_home/etc/users/UserName/AppName/history/SHName.csv file and the data is not indexed. Not sure if a retention applies there.

[rmacurak]

Indeed. It seems only the most recent 1000 searches are stored. I'm interested in increasing the retention. Any ideas what controls that retention limit?