User interface for event data store

A system comprising:

• a memory comprising instructions;
• and
• one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
• receiving a query comprising a first field value, a time period, and a content request;
• performing a first search of an event data store to identify a set of events occurring during the time period and having at least one field with a value equal to the first field value;
• determining, from the set of events, a first subset of events associated with a first context definition by:
• determining a first source type associated with the first subset of events;
• and
• determining that the first source type is associated with the first context definition;
• determining fields specified in the first context definition;
• determining, for events in the first subset of events, field values of one or more of the fields specified in the first context definition;
• determining, based on the field values of the one or more fields associated with the first context definition, content that satisfies the content request;
• generating a response to the query that includes the content that satisfies the content request;
• and
• presenting the response on a user interface.

A non-transitory machine-readable storage medium including instructions that, when executed by a machine, cause the machine to perform operations comprising:

• receiving a query comprising a first field value, a time period, and a content request;
• performing a first search of an event data store to identify a set of events occurring during the time period and having at least one field with a value equal to the first field value;
• determining, from the set of events, a first subset of events associated with a first context definition by:
• determining a first source type associated with the first subset of events;
• and
• determining that the first source type is associated with the first context definition;
• determining fields specified in the first context definition;
• determining, for events in the first subset of events, field values of one or more of the fields specified in the first context definition;
• determining, based on the field values of the one or more fields associated with the first context definition, content that satisfies the content request;
• generating a response to the query that includes the content that satisfies the content request;
• and
• presenting the response on a user interface.