Report acceleration using intermediate summaries

An apparatus, comprising:

• a subsystem, implemented at least partially in hardware, that determines, by a computing device, whether a data analysis performed for at least a portion of a first received search query is reusable for future received search queries;
• a subsystem, implemented at least partially in hardware, that periodically performs, by the computing device, the data analysis on at least a portion of data stored in at least one data store and saving results of the data analysis as an intermediate summary, wherein data stored in the at least one data store is partitioned based on time, and wherein the at least a portion of the data stored in the at least one data store is within a partition;
• a subsystem, implemented at least partially in hardware, that receives, by the computing device, a second query to generate a search report;
• a subsystem, implemented at least partially in hardware, that, in response to receiving the second search query, returns, by the computing device, the search report based on at least a search of an aggregated set of intermediate summaries and a search of ad hoc data, wherein data contained in the aggregated set of intermediate summaries is reusable for future search queries and wherein the search of ad hoc data is unique to the search report, wherein the ad hoc data is not summarized in the intermediate summaries, and wherein the aggregated set of intermediate summaries and the ad hoc data are from one or more partitions, and wherein the aggregated set of intermediate summaries includes one or more periodically saved intermediate summaries.

An apparatus, comprising:

• a subsystem, implemented at least partially in hardware, that periodically processes, by two or more computing devices, at least a portion of data stored in at least one data store accessible to each computing device among the two or more computing devices and saving results of the processing as an intermediate summary accessible to each respective computing device among the two or more computing devices, wherein data stored in the at least one data store is partitioned based on time, and wherein the at least a portion of the data stored in the at least one data store is within a partition;
• a subsystem, implemented at least partially in hardware, that receives, by a particular computing device among the two or more computing devices, a search query to generate a search report;
• a subsystem, implemented at least partially in hardware, that, in response to receiving the search query, returns, by the particular computing device, the search report based on at least a search of an aggregated set of intermediate summaries and a search of ad hoc data, wherein data contained in the aggregated set of intermediate summaries is reusable for future search queries and wherein the search of ad hoc data is unique to the search report, wherein the ad hoc data is not summarized in the intermediate summaries, and wherein the aggregated set of intermediate summaries and the ad hoc data are from one or more partitions, and wherein the aggregated set of intermediate summaries includes one or more periodically saved intermediate summaries.

A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

• determining, by a computing device, whether a data analysis performed for at least a portion of a first received search query is reusable for future received search queries;
• periodically performing, by the computing device, the data analysis on at least a portion of data stored in at least one data store and saving results of the data analysis as an intermediate summary, wherein data stored in the at least one data store is partitioned based on time, and wherein the at least a portion of the data stored in the at least one data store is within a partition;
• receiving, by the computing device, a second query to generate a search report;
• in response to receiving the second search query, returning, by the computing device, the search report based on at least a search of an aggregated set of intermediate summaries and a search of ad hoc data, wherein data contained in the aggregated set of intermediate summaries is reusable for future search queries and wherein the search of ad hoc data is unique to the search report, wherein the ad hoc data is not summarized in the intermediate summaries, and wherein the aggregated set of intermediate summaries and the ad hoc data are from one or more partitions, and wherein the aggregated set of intermediate summaries includes one or more periodically saved intermediate summaries.

A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

• periodically processing, by two or more computing devices, at least a portion of data stored in at least one data store accessible to each computing device among the two or more computing devices and saving results of the processing as an intermediate summary accessible to each respective computing device among the two or more computing devices, wherein data stored in the at least one data store is partitioned based on time, and wherein the at least a portion of the data stored in the at least one data store is within a partition;
• receiving, by a particular computing device among the two or more computing devices, a search query to generate a search report;
• in response to receiving the search query, returning, by the particular computing device, the search report based on at least a search of an aggregated set of intermediate summaries and a search of ad hoc data, wherein data contained in the aggregated set of intermediate summaries is reusable for future search queries and wherein the search of ad hoc data is unique to the search report, wherein the ad hoc data is not summarized in the intermediate summaries, and wherein the aggregated set of intermediate summaries and the ad hoc data are from one or more partitions, and wherein the aggregated set of intermediate summaries includes one or more periodically saved intermediate summaries.