1. A computer-implemented method, comprising: receiving, on a computing device, raw data; indexing the raw data, wherein indexing includes dividing the raw data into time stamped searchable events; storing the indexed data in an indexed data store; establishing a data volume limit on an amount of storage for a project in the indexed data store; receiving additional raw data; determining that the data volume limit has been reached for the project; and declining to store in the indexed data store additional indexed data resulting from indexing the additional raw data, wherein additional indexed data is declined for storage until after instructions have been received to increase the data volume limit for the project.