Patent ID: 11934418
Assignee: SPLUNK INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 19:
20. Non-transitory, computer readable storage media, storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to:
generate a group of events and a keyword portion of an index file associated with the group of events based at least in part on machine data received at a data intake and query system, wherein the keyword portion includes a reference to a location of an event of the group of events that includes a particular keyword;
store the group of events and the index file in one or more data stores; and
based at least in part on a determination that an attribute of at least one event of the group of events satisfies an index size optimization condition, removing the reference to the location of the event that includes the particular keyword from the index file, wherein following the removing the reference to the location of the event that includes the particular keyword from the index file, the event that includes the particular keyword remains available for searching via the one or more data stores,
wherein the index size optimization condition includes at least one of:
an amount of time elapsed since the group of events were generated,
an amount of time elapsed since occurrence of machine data correspond to one or more events of the group of events, or
a frequency with which the group of events has been accessed over a period of time,

wherein removing the at least a part of the keyword portion reduces an amount of storage space used by the index file in the one or more data stores.