I'm a big fan of summary indexing. Are you just putting the data into the index or are you running a stats command each time the search runs? (fyi, using stats on a saved search fails in 4.0.10!!! it's a bug they're working on)
For example, if your saved search was just "source=fw" and you're running stats on those results, you won't benefit from summary indexing. but "source=fw | stats count by protocol, port" you'd get what you want.
If you are doing the stats method, perhaps you should increase the span of the search and run it less frequently? This way your stats will aggregate more results, but your searches against the stats will have less data to process.
... View more