Report acceleration using intermediate results in a distributed indexer system for searching events

One or more non-transitory computer-readable media storing instructions that, when executed by one or more computer devices, cause performance of:

• receiving data on a computing device;
• parsing the data to create a set of events, wherein each event in the set of events includes a portion of the data;
• associating a time with each event in the set of events;
• storing the set of events in a partition to which an indexer in a set of distributed indexers has access;
• calculating, by the indexer, an intermediate result on data extracted from the set of events in the partition to improve response time for a recurring query whose recurrences are not all directed to identical time periods, the intermediate result including information used to satisfy two or more recurrences of the recurring query, wherein the times associated with the set of events in the partition are included in both a first time period and a second time period that only partially overlaps with the first time period;
• producing a first report covering the first time period by combining a partial result produced for the first time period by the indexer that has access to the partition with a partial result produced for the first time period by at least one other indexer, wherein the partial result for the first time period that is produced by the indexer with access to the partition is determined using the intermediate result;
• and
• producing a second report covering the second time period by combining a partial result produced for the second time period by the indexer with access to the partition with a partial result produced for the second time period by at least one other indexer, wherein the partial result for the second time period that is produced by the indexer with access to the partition is determined using the intermediate result and without further using the set of events used to calculate the intermediate result.

An apparatus, comprising:

• an indexer;
• a data receiver at a computing device, implemented at least partially in hardware, that receives data;
• a data parser at the computing device, implemented at least partially in hardware, that parses the data to create a set of events, wherein each event in the set of events includes a portion of the data;
• a time association subsystem at the computing device, implemented at least partially in hardware, that associates a time with each event in the set of events;
• a storage subsystem at the computing device, implemented at least partially in hardware, that stores the set of events in a partition to which an indexer in a set of distributed indexers has access;
• an intermediate result calculation subsystem at the indexer, implemented at least partially in hardware, that calculates an intermediate result on data extracted from the set of events in the partition to improve response time for a recurring query whose recurrences are not all directed to identical time periods, the intermediate result including information used to satisfy two or more recurrences of the recurring query, wherein the times associated with the set of events in the partition are included in both a first time period and a second time period that only partially overlaps with the first time period;
• a report production subsystem, implemented at least partially in hardware, that produces a first report covering the first time period by combining a partial result produced for the first time period by the indexer that has access to the partition with a partial result produced for the first time period by at least one other indexer, wherein the partial result for the first time period that is produced by the indexer with access to the partition is determined using the intermediate result;
• and
• wherein the report production subsystem produces a second report covering the second time period by combining a partial result produced for the second time period by the indexer with access to the partition with a partial result produced for the second time period by at least one other indexer, wherein the partial result for the second time period that is produced by the indexer with access to the partition is determined using the intermediate result and without further using the set of events used to calculate the intermediate result.