Using an inverted index in a pipelined search query to determine a set of event data that is further limited by filtering and/or processing of subsequent query pipestages

A method for searching data, the method comprising:

• providing a field searchable data store comprising a plurality of event records, each event record comprising a time-stamped portion of raw machine data;
• receiving an incoming query, wherein the incoming query is created using a pipelined search language;
• generating results for the incoming query using a pipelined process, the pipelined process comprising:
• responsive to the incoming query accessing an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and field value pair that identifies a location in the field searchable data store where an associated event record is stored, wherein the inverted index comprises summarization information indexed from the plurality of event records stored in the field searchable data store;
• in a first pipe-stage of the pipelined process, using the inverted index to generate a partial result set from the summarization information by filtering out a first subset of the plurality of event records, wherein the first subset comprises one or more event records with corresponding reference values in the inverted index;
• and
• in a second pipe-stage subsequent to the first pipe-stage, extracting information that is in addition to the summarization information in the inverted index from the first subset of the plurality of event records in response to commands in the second pipe-stage.