Query handling for field searchable raw machine data using a field searchable datastore or an inverted index

A network device that is operative for searching data, the network device comprising:

• a memory that is operative to store at least one instruction;
• and
• a processor device that is operative to execute instructions that enable actions, the actions comprising:
• providing an inverted index that comprises at least one record comprising at least one field name and a corresponding at least one field value extracted from time-stamped searchable events stored in a field searchable datastore, wherein said at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored;
• evaluating an incoming search query that references a field name;
• and
• responsive to the evaluating, determining results for the incoming search query by executing the incoming search query across the field searchable datastore and the inverted index, wherein the field name in the incoming search query is used to perform a search of the inverted index, and wherein a search of one or more keywords in the incoming search query is serviced using the field searchable datastore, wherein the one or more keywords comprise tokens for searching the field searchable datastore.

A processor readable non-transitive storage media that includes instructions wherein execution of the instructions by a processor device enables actions, wherein the actions comprise:

• providing an inverted index that comprises at least one record comprising at least one field name and a corresponding at least one field value extracted from time-stamped searchable events stored in a field searchable datastore, wherein the at least one record further comprises a posting value that identifies a location in the field searchable datastore where an event associated with the at least one record is stored;
• evaluating the incoming search query that references a field name;
• and
• responsive to the evaluating, determining results for the incoming search query by executing the incoming search query across the field searchable datastore and the inverted index, wherein the field name in the incoming search query is used to perform a search of the inverted index, and wherein a search of one or more keywords in the incoming search query is serviced using the field searchable datastore, wherein the one or more keywords comprise tokens for searching the field searchable datastore.