Metadata tracking for a pipelined search language (data modeling for fields)

A network device for managing data, comprising:

• a memory for storing data and instructions;
• and
• a processor that executes the instructions to enable actions, including:
• receiving a query, wherein the query includes a first command to retrieve a data set and a second command to process the retrieved data set, wherein processing includes characterizing a portion of the retrieved data set;
• retrieving the data set in accordance with the first command, wherein the data set includes a plurality of events, wherein each event in the plurality of events is time-stamped, and wherein at least one of the events in the plurality of events is derived from unstructured data;
• dividing the retrieved data set into a plurality of portions in accordance with the second command, wherein the retrieved data set is divided based on a first attribute in the data;
• generating a plurality of results, wherein each result in the plurality of results is generated from one of the plurality of portions in accordance with the second command, and wherein a result of the plurality of results characterizes a portion of the plurality of portions;
• generating metadata for each result in the plurality of results, wherein the metadata indicates that a result has a value for a second attribute;
• identifying a set of results of the plurality of results, wherein the set of results share a same value for the second attribute;
• and
• generating a visualization of the data set, wherein the visualization includes the identified set of results, and wherein the visualization groups the identified set of results.

A processor-readable non-transitory storage media that includes instructions for displaying data on at least one computing device, wherein the execution of the instructions by a processor enables actions, comprising:

• receiving a query, wherein the query includes a first command to retrieve a data set and a second command to process the retrieved data set, wherein processing includes characterizing a portion of the retrieved data set;
• retrieving the data set in accordance with the first command, wherein the data set includes a plurality of events, wherein each event in the plurality of events is time-stamped, and wherein at least one of the events in the plurality of events is derived from unstructured data;
• dividing the retrieved data set into a plurality of portions in accordance with the second command, wherein the retrieved data set is divided based on a first attribute in the data;
• generating a plurality of results, wherein each result in the plurality of results is generated from one of the plurality of portions in accordance with the second command, and wherein a result of the plurality of results characterizes a portion of the plurality of portions;
• generating metadata for each result in the plurality of results, wherein the metadata indicates that a result has a value for a second attribute;
• identifying a set of results of the plurality of results, wherein the set of results share a same value for the second attribute;
• and
• generating a visualization of the data set, wherein the visualization includes the identified set of results, and wherein the visualization groups the identified set of results.