Technologies for performing time constrained queries for real-time event flow visualizations and analytics

A system for performing time constrained queries for real-time event sequence visualization, the system comprising:

• at least one processor;
• and
• at least one memory comprising a plurality of instructions stored thereon that, in response to execution by the at least one processor, causes the system to:
• retrieve an event sequence dataset, wherein the event sequence dataset includes data for a plurality of event sequences and a plurality of events, and wherein each event sequence of the plurality of event sequences includes at least two sequentially occurring events;
• generate a forward search index that includes a plurality of event pattern sets, wherein each event pattern set corresponds to a respective pattern of events derived from the plurality of event sequences and includes pattern occurrence data for each event sequence of the plurality of event sequences, and wherein the pattern occurrence data for each event sequence is positioned within each event pattern set according to a fixed positional order;
• identify the fixed positional order of each event sequence positioned within each event pattern set of the plurality of event pattern sets of the forward search index;
• generate a time constraint search structure that includes a plurality of keys and a plurality of pointer values, wherein each pointer value of the plurality of pointer values is associated with one or more key values of the plurality of key values;
• insert a sequence identifier that corresponds to each event sequence of the plurality of event sequences into the time constraint search structure as a pointer value of the plurality of pointer values, wherein the sequence identifier that corresponds to each event sequence is indicative of the fixed positional order of the event sequence within each of the plurality of event patterns sets of the forward search index;
• and
• insert time interval data for the at least two sequentially occurring events of each event sequence into the time constraint search structure as a key value associated with a respective pointer value for the corresponding event sequence, wherein the time interval data for the at least two sequentially occurring events of each event sequence is indicative of an amount of time elapsed between an occurrence of each of the at least two sequentially occurring events of the event sequence.

One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that, in response to execution by a computing system, causes the computing system to:

• retrieve an event sequence dataset, wherein the event sequence dataset includes data for a plurality of event sequences and a plurality of events, and wherein each event sequence of the plurality of event sequences includes at least two sequentially occurring events;
• generate a forward search index that includes a plurality of event pattern sets, wherein each event pattern set corresponds to a respective pattern of events derived from the plurality of event sequences and includes pattern occurrence data for each event sequence of the plurality of event sequences, and wherein the pattern occurrence data for each event sequence is positioned within each event pattern set according to a fixed positional order;
• identify the fixed positional order of each event sequence positioned within each event pattern set of the plurality of event pattern sets of the forward search index;
• generate a time constraint search structure that includes a plurality of keys and a plurality of pointer values, wherein each pointer value of the plurality of pointer values is associated with one or more key values of the plurality of key values;
• insert a sequence identifier that corresponds to each event sequence of the plurality of event sequences into the time constraint search structure as a pointer value of the plurality of pointer values, wherein the sequence identifier that corresponds to each event sequence is indicative of the fixed positional order of the event sequence within each of the plurality of event patterns sets of the forward search index;
• insert time interval data for the at least two sequentially occurring events of each event sequence into the time constraint search structure as a key value associated with a respective pointer value for the corresponding event sequence, wherein the time interval data for the at least two sequentially occurring events of each event sequence is indicative of an amount of time elapsed between an occurrence of each of the at least two sequentially occurring events of the event sequence;
• receive a search request that includes a time interval constraint;
• search the time constraint search structure to identify one or more key values of the plurality of key values that satisfy the time interval constraint;
• determine, within the time constraint search structure, one or more pointer values associated with the one or more key values of the plurality of key values that satisfy the time interval constraint;
• and
• output the sequence identifier associated with each of the determined one or more pointer values.