Analysis of streaming data using deltas and snapshots

A non-transitory computer-readable medium with instructions stored thereon that, when executed by a hardware processor, cause the processor to perform operations comprising:

• receiving initial data that includes a plurality of identifiers and corresponding timestamps;
• generating and storing a snapshot based on the initial data, wherein the snapshot includes each of the identifiers and a corresponding status;
• receiving a data stream that includes a subset of the identifiers, activity information for each identifier in the subset of the identifiers, and corresponding timestamps, wherein the data stream is received after receiving the initial data;
• periodically analyzing the data stream to obtain a delta that includes an updated status for each identifier in the subset of identifiers;
• storing the delta separate from the snapshot;
• receiving a request for identifiers that are active in a particular time period;
• and
• based on the particular time period, retrieving active identifiers from the data stream, the delta, or the snapshot.

A computer-implemented method comprising:

• accessing an activity log, wherein the activity log includes a plurality of entries indicative of updates to two or more datastore tables and wherein each entry in the activity log has a respective timestamp;
• obtaining a delta from the activity log for each table of the two or more tables, wherein each row of the delta is keyed by a key of the corresponding table;
• determining that at least two of the respective deltas are keyed by a same field;
• and
• obtaining a stitched delta by combining the rows of the at least two of the respective deltas, wherein the stitched delta is keyed by the same field.