Distributed high performance analytics store

A computer-implemented system for generating a result set among a plurality of distributed locations said system comprising:

• one or more processors;
• one or more non-transitory computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including:
• receiving raw data;
• segmenting the raw data into a set of time-stamped event records;
• dividing the set of time-stamped event records events into two or more partitions of event records;
• indexing and storing each time-stamped event record of each of the two or more partitions of event records, wherein each of the two or more partitions of event records are stored at a different one of a plurality of distributed locations in a distributed indexed data store;
• for each partition of event records, generating a summarization table that:
• identifies one or more field-value combinations, wherein a field-value combination includes a field and a value that appears in one or more of the event records of that partition for that field, and wherein a data model or a command is used to identify one or more fields for inclusion in the summarization table;
• and
• for each field-value combination, identifies a set of one or more posting values of event records of that partition that have the value for the field, wherein a posting value provides a way to retrieve the event record to which it corresponds from the distributed indexed data store;
• receiving a query;
• generating one or more partial results for the query, wherein the one or more partial results are generated using the summarization table for a partition of event records, and wherein the one or more partial results are generated without evaluating each individual event record in the partition of event records;
• and
• generating a result set responsive to the query, wherein the result set is generated using the one or more partial results.

A computer-program product for generating a result set among a plurality of distributed locations, tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to:

• receive raw data;
• segment the raw data into a set of time-stamped event records;
• divide the set of time-stamped event records into two or more partitions of event records;
• index and store each time-stamped event record of each of the two or more partitions of event records wherein each of the two or more partitions of event records are stored at a different one of a plurality of distributed locations in a distributed indexed data store;
• for each partition of event records, generate a summarization table that:
• identifies one or more field-value combinations, wherein a field-value combination includes a field and a value that appears in one or more of the event records of that partition for that field, and wherein a data model or a command is used to identify one or more fields for inclusion in the summarization table;
• and
• for each field-value combination, identifies a set of one or more posting values of event records of that partition that have the value for the field, wherein a posting value provides a way to retrieve the event record to which it corresponds from the distributed indexed data store;
• receive a query;
• generate one or more partial results for the query, wherein the one or more partial results are generated using the summarization table for a partition of event records, and wherein the one or more partial results are generated without evaluating each individual event record in the partition of event records;
• and
• generate a result set responsive to the query, wherein the result set is generated using the one or more partial results.