Fast ad-hoc filtering of time series analytics

A search system for producing time-series data based, at least in part, on document creation time, the search system comprising:

• a first set of posting lists, the first set of posting lists storing index information for a set of documents, wherein the set of documents are generated from a plurality of events based on user activity within a computing environment;
• and
• a second set of posting lists, the second set of posting lists storing index information for a plurality of time ranges, wherein the second set of posting lists stores mappings between the plurality of time ranges and documents created within each of the plurality of time ranges;
• wherein the search system is configured perform operations comprising:
• receiving a search query;
• executing the search query using the first set of posting lists to produce matching documents;
• performing search faceting on the matching documents using, at least in part, the second set of posting lists, wherein the performing search faceting on the matching documents comprises:
• for each time range of the plurality of time ranges:
• generating a count of documents, of the matching documents, that are present in index information for the time range;
• and
• returning time-series data comprising the count of documents for each time range.

A computer-readable storage medium storing computer-executable instructions for causing a computing device to perform a method for producing time-series data based, at least in part, on document creation time, the method comprising:

• creating a first set of posting lists, comprising:
• for each of a plurality of events based on user activity within a computing environment:
• receiving the event;
• retrieving meta-data associated with the event;
• and
• storing the event and the meta-data as a document;
• and
• indexing the documents for the plurality of events, as a set of documents, to create the first set of posting lists;
• creating a second set of posting lists, comprising:
• for each of a plurality of time ranges, storing index information identifying which documents, of the set of documents, were created within the time range;
• and
• storing the first set of posting lists and the second set of posting lists for use during execution of search queries and search faceting to produce time-series data.