Maintaining temporal associations for event data in an event database

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform steps of:

• detecting a plurality of events, each of the events being associated with one of a plurality of assets of an enterprise system;
• generating a plurality of database record structures based at least in part on the detected events, each of the database record structures comprising a first field storing an association key identifying one of the plurality of assets, a second field storing a first timestamp associated with a first detected event stored in that database record structure for its identified asset, and at least a third field storing a value associated with a second detected event stored in that database record structure for its identified asset;
• maintaining indexing structures for at least the first field, the second field and the third field of the plurality of database record structures;
• receiving a query to resolve a temporal association for a queried one of the plurality of assets at a specified time;
• and
• utilizing the indexing structures to locate a particular one of the plurality of database record structures storing the temporal association for the queried asset at the specified time;
• wherein each of at least a subset of the plurality of database record structures comprises one of:
• an open database record structure where the value stored in the third field comprises a predetermined value indicating that the database record structure is an open database record structure;
• and
• a closed database record structure where the value stored in the third field comprises a second timestamp associated with the second detected event;
• wherein the plurality of database record structures comprises two or more database record structures for a given one of the plurality of assets;
• and
• wherein the two or more database record structures for the given one of the plurality of assets comprise at least one closed database record structure for the given one of the plurality of assets, and at least one open database record structure for the given one of the plurality of assets.

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured to perform steps of:
• detecting a plurality of events, each of the events being associated with one of a plurality of assets of an enterprise system;
• generating a plurality of database record structures based at least in part on the detected events, each of the database record structures comprising a first field storing an association key identifying one of the plurality of assets, a second field storing a first timestamp associated with a first detected event stored in that database record structure for its identified asset, and at least a third field storing a value associated with a second detected event stored in that database record structure for its identified asset;
• maintaining indexing structures for at least the first field, the second field and the third field of the plurality of database record structures;
• receiving a query to resolve a temporal association for a queried one of the plurality of assets at a specified time;
• and
• utilizing the indexing structures to locate a particular one of the plurality of database record structures storing the temporal association for the queried asset at the specified time;
• wherein each of at least a subset of the plurality of database record structures comprises one of:
• an open database record structure where the value stored in the third field comprises a predetermined value indicating that the database record structure is an open database record structure;
• and
• a closed database record structure where the value stored in the third field comprises a second timestamp associated with the second detected event;
• wherein the plurality of database record structures comprises two or more database record structures for a given one of the plurality of assets;
• and
• wherein the two or more database record structures for the given one of the plurality of assets comprise at least one closed database record structure for the given one of the plurality of assets, and at least one open database record structure for the given one of the plurality of assets.