Scalable analytical processing of structured data

A system for use in monitoring one or more platforms of one or more data systems, comprising:

• A processor;
• and
• a memory connected to the processor and comprising a set of computer readable instructions that are executable by the processor to;
• receive structured data generated by one or more platforms over at least one communications network;
• first evaluate, using a first rule block, at least some of the data by making a determination about a content of one or more fields of the at least some of the data;
• first determine, from the first evaluating, that a result is one of at least first and second outcomes;
• and
• depending upon the first determining, second evaluate, using a second rule block, at least some of the data by making a determination about a content of one or more fields of the at least some of the data, wherein a content of one of the fields that are first evaluated matches a content of one of the fields that are second evaluated;
• and
• second determine, from the second evaluating, whether a result is one of at least first and second outcomes, wherein the results are analyzed to determine an event of interest.

A method for use in monitoring one or more platforms of one or more data systems, comprising:

• receiving, at a processing engine, structured data generated by one or more platforms over at least one communications network;
• first evaluating, at the processing engine using one of first and second rule blocks, at least some of the data, wherein the first evaluating comprises making a determination about a content of one or more fields of the at least some of the data;
• first determining that a result of the first evaluating is a first of at least first and second outcomes, wherein the at least some of the data leading to the first outcome is identified by a time stamp that corresponds to a first time;
• second evaluating, at the processing engine using the other of the first and second rule blocks, at least some of the data associated with one or more time stamps that correspond to one or more second times having a specified relationship to the first time, wherein the second evaluating comprises making a determination about a content of one or more fields of the at least some of the data;
• second determining, from the second evaluating, whether a result is one of at least first and second outcomes, wherein the results are analyzed to determine an event of interest, and wherein a content of one of the fields in the
• first evaluating matches a content of one of the fields in the second evaluating.