Patent ID: 8682925

Claim:
A computer-implemented method for generating a result set among a plurality of distributed locations, the method comprising: receiving, at a computing device, raw data; segmenting the raw data into a set of time-stamped event records; dividing the set of time-stamped event records into two or more partitions of event records; indexing and storing each time-stamped event record of each of the two or more partitions of event records, wherein each of the two or more partitions of event records are stored at a different one of a plurality of distributed locations in a distributed indexed data store; for each partition of event records, generating a summarization table that: identifies one or more field-value combinations, wherein a field-value combination includes a field and a value that appears in one or more of the event records of that partition for that field, and wherein a data model or a command is used to identify one or more fields for inclusion in the summarization table; and for each field-value combination, identifies a set of one or more posting values of event records of that partition that have the value for the field, wherein a posting value provides a way to retrieve the event record to which it corresponds from the distributed indexed data store; receiving a query; generating one or more partial results for the query, wherein the one or more partial results are generated using the summarization table for a partition of event records, and wherein the one or more partial results are generated without evaluating each individual event record in the partition of event records; and generating a result set responsive to the query, wherein the result set is generated using the one or more partial results.