Patent Document ID: 9965550
Application ID: 14323499

Base Claim:
1. A method by a computer in communication with one or more network host machines of a data network, the method comprising: receiving a search query from a user equipment in communication with the computer, the search query defining a set of a plurality of logical combination of terms to be searched within a defined interval of records of a log stream received from the one or more network host machines of the data network; for each of the logical combinations of terms in the set, generating an estimate for the number of occurrences of the logical combination of terms in the defined interval of records using information of one of a bit-array data structure, a min-wise independent permutation locality sensitive hashing (MinHash) data structure, and a histogram data structure characterizing occurrences of a unique term contained within the defined interval of records of the log stream, wherein the unique term is one of the terms in the set of the plurality of logical combination of terms defined by the search query; communicating toward the user equipment a message containing the estimate for the number of occurrences for each of the logical combination of terms in the set within in the defined interval of records; obtaining a selection of at least one logical combination of terms from the set of the plurality of logical combination of terms based on the generated estimate of the at least one logical combination of terms; and modifying the search query using the selected at least one logical combination of terms; and performing the modified search query against the defined interval of records of the log stream to obtain a modified search query result set.

---

Claim 2:
2. The method of claim 1 , further comprising: for each unique term occurring in the record corresponding to the interval, generating an estimate for the number of occurrences of the unique term in the defined interval of records; and including in the message communicated toward the user equipment the estimates for the number of occurrences of each unique term in the defined interval of records.