Patent ID: 8990184
Filing Date: 2015-03-24
Classification: G06F

Abstract:
1. A method for building a searchable data store, comprising: repeatedly generating buckets in memory to receive events, electronically receiving machine data produced by devices in an information processing environment, separating the machine data into events at boundaries between contiguous portions of the machine data, applying the time stamps to the events, and inserting a respective event into a respective bucket based at least in part on a respective applied time stamp; wherein the machine data included in the events includes textual data; wherein the events are indexed; wherein applying the respective time stamp to the respective event includes applying an extraction rule to extract time information to use as the time stamp from the textual data included in the respective event; wherein the respective bucket receiving the respective event is a hot bucket; and advancing a filled hot bucket to warm bucket status that does not accept further events; wherein at least events in warm buckets are searchable.