Patent ID: 11971893
Assignee: RAPID7, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 11:
12. A system, comprising:
one or more hardware processors with associated memory that implement a bounded group by query system, configured to:
receive a query specifying to compute statistics for different groups of timestamped records in a dataset and in a plurality of time slices;
perform the query, including to:
allocate a result grouping structure (RGS) and an approximate result grouping structure (ARGS), wherein the RGS is configured to store exact group statistics for up to a maximum number of groups from the different groups of timestamped records and the ARGS is configured to store approximate group statistics for additional groups above the maximum number from the different groups of timestamped records;
in a single pass scan of at least a portion of the different groups of timestamped records in the dataset:
accumulate exact group statistics in the RGS for the maximum number of groups from the different groups of timestamped records; and
accumulate approximate group statistics in the ARGS for one or more additional groups above the maximum number from the different groups of timestamped records based on a count-min sketch; and

provide a response to the query via a graphical user interface based at least in part on the RGS and the ARGS, wherein the graphical user interface includes a three-dimensional time graph that indicates, in the time slices, the exact group statistics for the maximum number of the groups and the approximate group statistics for the one or more additional groups above the maximum number; and
indicate on the graphical user interface a recommendation to zoom in on a particular time slice in the three-dimensional time graph, wherein the particular time slice is selected based on a number of approximate results in the particular time slice exceeding a configured threshold.