Patent ID: 11940967
Assignee: SPLUNK INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 9:
10. A network device that is operative for searching data, the network device comprising:
a memory that is operative to store at least one instruction; and
a processor device that is operative to execute instructions that enable actions, the actions comprising:
providing an inverted index that comprises at least one record comprising at least one field name and a corresponding at least one field value extracted from time-stamped searchable events, wherein the at least one record comprises a posting value that identifies a location in a record datastore where an event associated with the at least one record is stored, and wherein the time-stamped searchable events comprise portions of raw machine data and are stored in the record datastore;

evaluating an incoming search query that references a field name and comprises commands directed towards searching data from the record datastore, wherein the field name in the incoming search query is defined by a regular expression rule, wherein the regular expression rule comprises instructions for parsing a value associated with the field name out of at least one of the time-stamped searchable events; and
responsive to the evaluating, determining results for the incoming search query by executing the incoming search query across either the record datastore or the inverted index, or both the record datastore and the inverted index, wherein the inverted index is employed separately from the record datastore to generate a response to the incoming search query.