Add sourcetypes or sources that are relevant to ignore the other data. Add strings that must exist, such as ads and EventCode=* or even ( EventCode>4000 EventCode<6000 ). The more you can reduce the payload early, the better it will perform.
Use the Job Inspector to see where time is being spent. Perhaps there's a field extraction being performed that you don't need.
Is this running in fast mode?
You might even try (not sure if it will help) doing the stats first to reduce the result set: