Managing, storing, and caching query results and partial query results for combination with additional query results

Non-transitory computer readable media comprising computer-executable instructions that, when executed by a computing system of a data intake and query system, cause the computing system to:

• receive a first query identifying a first set of data to be processed and a manner of processing the first set of data;
• identify a plurality of time series buckets that stores the first set of data based at least in part on a respective identifier for each time series bucket of the plurality of time series buckets, wherein the plurality of time series buckets is located in a remote shared storage system, and wherein each time series bucket of the plurality of time series buckets stores raw machine data associated with a timestamp;
• identify a first plurality of containerized search nodes from a group of containerized search nodes to execute the first query, wherein the group of containerized search nodes are implemented as distinct containers in a shared computing resource environment and wherein each time series bucket of the plurality of time series buckets is accessible by any one of the group of containerized search nodes;
• execute the first query using the first plurality of containerized search nodes;
• store results of the first query in a data store for combination with additional query results, wherein the data store is accessible by any one of the group of containerized search nodes;
• receive a second query identifying a second set of data to be processed and a manner of processing the second set of data;
• identify a second plurality of containerized search nodes from the croup of containerized search nodes to execute the second query;
• and
• execute the second query using the second plurality of containerized search nodes, wherein the executing the second query comprises combining at least a portion of results of the second query with at least a portion of the results of the first query.

A computing system, comprising:

• memory;
• and
• one or more processing devices coupled to the memory and configured to:
• receive a first query identifying a first set of data to be processed and a manner of processing the first set of data;
• identify a plurality of time series buckets that stores the first set of data based at least in part on a respective identifier for each time series bucket of the plurality of time series buckets, wherein the plurality of time series buckets is located in a remote shared storage system, and wherein each time series bucket of the plurality of time series buckets stores raw machine data associated with a timestamp;
• identify a first plurality of containerized search nodes from a group of containerized search nodes to execute the first query, wherein the group of containerized search nodes are implemented as distinct containers in a shared computing resource environment and wherein each time series bucket of the plurality of time series buckets is accessible by any one of the group of containerized search nodes;
• execute the first query using the first plurality of containerized search nodes;
• store results of the first query in a data store for combination with additional query results, wherein the data store is accessible by any one of the group of containerized search nodes;
• receive a second query identifying a second set of data to be processed and a manner of processing the second set of data;
• identify a second plurality of containerized search nodes from the group of containerized search nodes to execute the second query;
• and
• execute the second query using the second plurality of containerized search nodes, wherein the executing the second query comprises combining at least a portion of results of the second query with at least a portion of the results of the first query.