Ready to dive into the LEM techronomicon? Here we go...
The LEM generates new partitions as event data comes in, and drops old partitions as the disk fills up. The frequency of this creation is based partially on size and partially on event count. If you want to see all the partitions, you can run the Database Maintenance Report, and it'll list all of them.
Now, if you were to root into the LEM and look at the alert DB, you'd see that some number of the newest partitions are big, like a gigabyte or so. These are the "Warm" partitions. The rest of them are a lot smaller, usually in the neighborhood of 200 to 500 MB. The reason for this is the LEM has compressed the partition a bunch and removed the "warm" files to increase the amount of data you can store on the LEM.
The number of partitions the LEM keeps "warm" is based in part on the memory you have assigned to the LEM and on what we've found is most optimal in testing, but we strive for a week of data warm at any given time. If you're searching for a date range in the warm partitions, searches should be pretty quick: all the LEM has to do is execute the query.
But let's say that you're going way back in time, and searching. Now the LEM has to find the partition(s) with the data you want in them, load them into memory, decompress them, run the query, recompress them and provide you the results. This takes extra time and resources on the box, so searches in the past will always be slower but it means you can retain more data on a smaller disk.