Patent ID: 11880399
Assignee: SPLUNK INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 18:
19. A computing system, comprising:
memory; and
one or more processing devices coupled to the memory and configured to:
maintain a plurality of inverted indexes, each inverted index of inverted indexes comprising a plurality of entries, each entry of the entries comprising:
a token or a field-value pair, and
one or more event references, each event reference of the one or more event references indicative of an event that is associated with the token or a field-value corresponding to the field-value pair;

identify a set of the event references from the plurality of inverted indexes;
categorize, using a plurality of field-value pairs in at least a portion of the plurality of inverted indexes, the set of event references according to categorization criteria, wherein the categorization criteria identifies one or more fields to categorize the set of event references, wherein categorization criteria-value pairs correspond to unique combinations of the one or more fields and field values of the one or more fields; and
in response to a request received from a device:
generate one or more groupings based at least in part on the categorizing the set of event references, wherein a given grouping of the one or more groupings includes a group of the event references corresponding to a group of events that have the same field-value for a field of the one or more fields; and
cause display, via a graphical user interface, of the one or more groupings.