help to improve disk quota

[jip31]

Hi

I use a search wich is enough verbose because it queries on system events base on different tokens

By default all these tokens are put on "*"

index=toto sourcetype="system" site="$Site$" type=$type$ name="$name$"

 I would like to know if there is a solution to reduce the disk quota and the number of events without playing with the timepicker or without playing with tokens?

thanks

[ITWhisperer · Accepted solution]

What do you mean by disk quota?

If this is to do with the amount of data returned by the primary search, apart from modifying the search criteria, e.g. earliest/latest, and field-based filters (with or without tokens), how else do you imagine this might be specified?

Or do you want to increase the amount of space a user can use?

[jip31]

I mean quoto disk in the task manager

it was just a question about hypothetic interesting trick

so I consider there nothing else about timepicker and filtering