Time series search with interpolated time stamp

A system for searching time series data, the system comprising:

• at least one network interface that enables communication over the network;
• one or more memories that store instructions;
• one or more processors that execute the instructions to enable performance of actions, including:
• gathering, using a computing device, a stream of data from an information processing environment;
• separating the stream of data into a plurality of events, each event including a respective portion of the stream of data;
• for each event of the plurality of events, determining an associated time stamp representing a time for the event;
• wherein determining the associated time stamp for an event of the plurality of events comprises interpolatin time information to use in the time stamp from known times corresponding to portions of the stream of data surrounding the portion of the stream of data included in the event;
• assigning each event of the plurality of events to a bucket having an associated time range that includes the time represented by the time stamp for the event;
• receiving a search query that includes a time criterion and a second criterion for selection of events, the second criterion relating to a segment within the events, the segment identified by an extraction rule for extracting a subportion of data from the portion of the stream of data included in an event, the extraction rule using a pattern to identify boundaries of the subportion of data being extracted;
• identifying one or more buckets that each have an associated time range, at least one time in each associated time range satisfying the time criterion;
• based on examining events only in the identified one or more buckets, identifying a set of events that match the time criterion and have a segment that matches the second criterion;
• determining a result based on the set of events;
• and
• causing the result to be displayed.

A processor readable non-volatile storage media that includes instructions for searching data, wherein execution of the instructions by one or more processors enable actions, the actions comprising:

• gathering, using a computing device, a stream of data from an information processing environment;
• separating the stream of data into a plurality of events, each event including a respective portion of the stream of data;
• for each event of the plurality of events, determining an associated time stamp representing a time for the event;
• wherein determining the associated time stamp for an event of the plurality of events comprises time information to use in the time stamp from known times corresponding to portions of the stream of data surrounding the portion of the stream of data included in the event;
• assigning each event of the plurality of events to a bucket having an associated time range that includes the time represented by the time stamp for the event;
• receiving a search query that includes a time criterion and a second criterion for selection of events, the second criterion relating to a segment within the events, the segment identified by an extraction rule for extracting a subportion of data from the portion of the stream of data included in an event, the extraction rule using a pattern to identify boundaries of the subportion of data being extracted;
• identifying one or more buckets that each have an associated time range, at least one time in each associated time range satisfying the time criterion;
• based on examining events only in the identified one or more buckets, identifying a set of events that match the time criterion and have a segment that matches the second criterion;
• determining a result based on the set of events;
• and
• causing the result to be displayed.