Patent Document ID: 9753974
Application ID: 13662984

Base Claim:
1. A method comprising: providing a datastore comprising a plurality of time-stamped, searchable events, each event having a portion of raw data and a timestamp extracted from the portion of raw data, the portion of raw data produced by at least one hardware system; providing a data structure that contains a plurality of field names, each field name among the plurality of field names associated with a set of pointers to time-stamped, searchable events having a value for a field referred to by the field name; receiving an incoming search query that references one or more field names among the plurality of field names contained in the data structure and a time range criteria; and in response to the incoming search query, servicing the incoming search query by: (i) executing the incoming search query across the data structure, wherein one or more values from the data structure are used to create a search result; and (ii) supplementing the search result by executing a search comprising the time range criteria of the incoming search query across the time-stamped searchable events, independent of the data structure.

---

Claim 10:
10. The method of claim 1 , further comprising: while creating the data structure, searching the time-stamped searchable events for a value for a field using an extraction rule.