Scalable interactive display of distributed data

A computer-implemented system, comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable storage mediums containing instructions configured to cause the one or more processors to perform operations including:
• maintaining a set of time stamped events in an indexed data store, wherein the indexed data store is accessible by one or more computer servers in a plurality of computer servers;
• sending a request to query the time stamped events, wherein the query is executable by a distributed server in the plurality of computer servers, and wherein the distributed server is responsible for searching a portion of the set of time stamped events;
• receiving result information including one or more event identifiers, wherein the result information is based on one or more event records that satisfy the query, wherein each event identifier corresponds to an event record, and wherein an event identifier includes information for locating the event record;
• aggregating the result information that satisfies the query;
• displaying the aggregated result information;
• receiving input requesting additional information based on one or more time stamped events that satisfy the request;
• determining one or more event records that include the additional information;
• determining an event identifier that corresponds to each of the determined one or more event records;
• sending a new request for the determined one or more event records, wherein event identifiers are used to locate corresponding event records accessible on the distributed server;
• receiving the determined one or more event records that satisfy the new request;
• and
• displaying the requested additional information.

A computer-program product, tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to:

• maintain a set of time stamped events in an indexed data store, wherein the indexed data store is accessible by one or more computer servers in a plurality of computer servers;
• send a request to query the time stamped events, wherein the query is executable by a distributed server in the plurality of computer servers, and wherein the distributed server is responsible for searching a portion of the set of time stamped events;
• receive result information including one or more event identifiers, wherein the result information is based on one or more event records that satisfy the query, wherein each event identifier corresponds to an event record, and wherein an event identifier includes information for locating the event record;
• aggregate the result information that satisfies the query;
• display the aggregated result information;
• receive input requesting additional information based on one or more time stamped events that satisfy the request;
• determine one or more event records that include the additional information;
• determine an event identifier that corresponds to each of the determined one or more event records;
• send a new request for the determined one or more event records, wherein event identifiers are used to locate corresponding event records accessible on the distributed server;
• receive the determined one or more event records that satisfy the new request;
• and
• display the requested additional information.