Generating sparse indices for event log information

A non-transitory computer-readable medium comprising memory with instructions encoded thereon that, when executed by one or more processors, cause the one or more processors to perform operations, the instructions comprising instructions to:

• buffer a plurality of event logs during a time window;
• populate a sparse index by, for each respective term of a plurality of indexable terms within buffered event logs:
• determining a respective count of event logs having the respective term during the time window,
• determining whether the respective count exceeds a threshold,
• responsive to determining that the respective count does not exceed the threshold, indexing the respective term, and
• responsive to determining that the respective count exceeds the threshold, refraining from indexing the respective term;
• receive a search query for a string of terms;
• and
• return matching ones of the plurality of event logs as results of the search query using the sparse index.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• buffering a plurality of event logs during a time window;
• populating a sparse index by, for each respective term of a plurality of indexable terms within buffered event logs:
• determining a respective count of event logs having the respective term during the time window,
• determining whether the respective count exceeds a threshold,
• responsive to determining that the respective count does not exceed the threshold, indexing the respective term, and
• responsive to determining that the respective count exceeds the threshold, refraining from indexing the respective term;
• receiving a search query for a string of terms;
• and
• returning matching ones of the plurality of event logs as results of the search query using the sparse index.