Customized reporting and mining of event data

A non-transitory computer-readable storage medium storing instructions, the instructions configured to cause a computer to perform operations comprising:

• receiving a report search query from one more event data collectors;
• parsing the report search query to determine a specified attribute of an event being searched;
• retrieving values or statistics associated with the specified attribute;
• determining a co-occurring attribute of the specified attribute;
• aggregating at least one of values or statistics associated with the co-occurring attribute;
• and
• generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises:
• projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data;
• and
• determining the statistics on the co-occurring attribute using a combination of:
• an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute;
• and
• an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair.

A system comprising:

• one or more computing devices configured to perform operations comprising:
• receiving a report search query from one more event data collectors;
• parsing the report search query to determine a specified attribute of an event being searched;
• retrieving values or statistics associated with the specified attribute;
• determining a co-occurring attribute of the specified attribute;
• aggregating at least one of values or statistics associated with the co-occurring attribute;
• and
• generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises:
• projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data;
• and
• determining the statistics on the co-occurring attribute using a combination of:
• an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute;
• and
• an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair.