Enriching search results with provenance information in an observability pipeline system

A computer node comprising a search engine configured to perform operations comprising:

• receiving a search query from a leader role in an observability pipeline system, the search query representing a request to search event data at a computer resource;
• configuring an observability pipeline process to perform a search according to the search query;
• obtaining search results based on applying the observability pipeline process to the event data, the search results comprising a plurality of events from the event data;
• obtaining provenance information for the plurality of events;
• generating augmented search results by associating the provenance information with respective events;
• and
• communicating the augmented search results to the leader role, wherein the provenance information includes a field indicating on which computer resource respective events of the plurality events are stored and allows a user device to initiate a session on the computer resource, wherein the computer resource is a second computer node.

A non-transitory computer-readable medium storing instructions that are operable when executed by data processing apparatus to perform operations comprising:

• receiving a search query from a leader role in an observability pipeline system, the search query representing a request to search event data at a computer resource;
• configuring an observability pipeline process to perform a search according to the search query;
• obtaining search results based on applying the observability pipeline process to the event data, the search results comprising a plurality of events from the event data;
• obtaining provenance information for the plurality of events;
• generating augmented search results by associating the provenance information with respective events;
• and
• communicating the augmented search results to the leader role, wherein the provenance information includes a field indicating on which computer resource respective events of the plurality events are stored and allows a user device to initiate a session on the computer resource, wherein the computer resource is a computer node.