Splunk SPL Search History changes

Available Languages

Updated:October 3, 2026
Document ID:SPLK055300

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

Modifications can be made to Splunk Enterprise by editing limits.conf under the [search] stanza to adjust the Splunk search history limits. You can open the file on the appropriate instance, locate the [search] stanza, and change the relevant settings to increase or decrease the stored search history according to your needs. 


Investigation

It was identified that a user needed more SPL searches saved in Splunk's History memory


Resolution

Create a $SPLUNK_HOME/etc/system/local/limits.conf file if it does not already exist.
In limits.conf

[search]
max_history_length = 2000

This is from the documentation:

max_history_length = <int>
* Max number of searches to store in history (per user/app)
* Defaults to 1000

limits.conf

Revision History

Revision Publish Date Comments
1.0
03-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products

Related Articles