Patent ID: 8583631

Claim:
A computer-implemented method, comprising: receiving a query, wherein the query includes a first command to retrieve a data set and a second command to process the retrieved data set, wherein processing includes characterizing a portion of the retrieved data set; retrieving the data set in accordance with the first command, wherein the data set includes a plurality of events, wherein each event in the plurality of events is time-stamped, and wherein at least one of the events in the plurality of events is derived from unstructured data; dividing the retrieved data set into a plurality of portions in accordance with the second command, wherein the retrieved data set is divided based on a first attribute in the data; generating a plurality of results, wherein each result in the plurality of results is generated from one of the plurality of portions in accordance with the second command, and wherein a result of the plurality of results characterizes a portion of the plurality of portions; generating metadata for each result in the plurality of results, wherein the metadata indicates that a result has a value for a second attribute; identifying a set of results of the plurality of results, wherein the set of results share a same value for the second attribute; and generating a visualization of the data set, wherein the visualization includes the identified set of results, and wherein the visualization groups the identified set of results.