Generating a query response by combining partial results from separate partitions of event records

A non-transitory computer-readable medium having computer-readable program code embodied therein for causing a computer system to perform a method for generating a query response, the method comprising:

• creating two or more partitions of event records that are field searchable and time-stamped from raw data stored in a data store, wherein each event record in the two or more partitions of event records includes a portion of the raw data and is associated with a time stamp derived from the raw data;
• indexing and storing each event record of each of the two or more partitions of event records;
• generating a respective summarization table for each partition of the two or more partitions that:
• identifies a field value comprising a value that corresponds to an associated field extracted from a respective record;
• and
• for the field value, includes a posting value to the respective event record within a respective partition, wherein the respective event record contains the field value for the associated field;
• generating one or more partial results for a received query using summarization tables for the two or more partitions;
• and
• generating a response to the received query by combining the one or more partial results.

A system for performing a method for generating a query response, the system comprising:

• a processing device communicatively coupled with a memory and configured to:
• creating two or more partitions of event records that are field searchable and time-stamped from raw data stored in a data store, wherein each event record in the two or more partitions of event records includes a portion of the raw data and is associated with a time stamp derived from the raw data;
• indexing and storing each event record of each of the two or more partitions of event records;
• generating a respective summarization table for each partition of the two or more partitions that:
• identifies a field value comprising a value that corresponds to an associated field extracted from a respective record;
• and
• for the field value, includes a posting value to the respective event record within a respective partition, wherein the respective event record contains the field value for the associated field;
• generating one or more partial results for a received query using summarization tables for the two or more partitions;
• and
• generating a response to the received query by combining the one or more partial results.