Hi @williamtan,
There really isn't recommended retention period (at least not that I'm aware of it). This depends on your requirements and environment. For some large organizations, that generate high volume of logs, it is not even possible to store logs on ISE for a longer period, due to the amount of data. For others, data retention can be over 1-2 years, as they have small amount of logs and large datastores.
Longer period means that you'll have more data on your system, meaning that your search might get slower. You can refer to ISE VM Deployment Guide, which has a section for Disk Space Guidelines. There you can see some estimations about disk size, number of endpoints and expected retention period. Of course, these are just estimations based on some assumptions, but it turned out that they are quite correct.
BR,
Milos
