Searchable investigation history for event data store

A computer readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations com prising:

• receiving, by the processing device, a first query comprising a first field value and a first time period;
• performing, by the processing device, a first search of a data store to identify a first plurality of events having the first time period and at least one field that comprises the first field value;
• generating, by the processing device, a first search object comprising the first field value, wherein the first search object comprises a data structure, file, or data record, and is stored in the data store;
• generating, by the processing device, a first search event comprising the first field value and a reference to the first search object;
• and
• writing an event entry for the first search event to the data store.

A system comprising:

• a data store to store a plurality of events;
• and
• a computing device, operatively coupled to the data store, to:
• receive a first query comprising a plurality of field values and a first time period;
• perform a first search of the data store to identify a first subset of the plurality of events having the first time period and the plurality of field values;
• generate a first search object comprising the plurality of field values, wherein the first search object comprises a data structure, file, or data record, and is stored in the data store;
• generate a first search event comprising a second time period that at least partially overlaps the first time period, a reference to the first search object, and the plurality of field values;
• and
• write a plurality of event entries for the first search event to the data store, wherein a separate event entry is written to the data store for each field value of the plurality of field values.