Expiration of Persistent Data Structures That Satisfy Search Queries

摘要

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is organized into discrete events with normalized time stamps and the events are indexed by time and keyword. A search is received and relevant event information is retrieved based in whole or in part on the time indexing mechanism, keyword indexing mechanism, or statistical indices calculated at the time of the search.

主权项

1. A method, comprising:
receiving raw data from a plurality of sources; creating a plurality of events based on the raw data; associating a time stamp with an event in the plurality of events; indexing the time stamped event according to an indexing policy to create persistent data structures for searching the plurality of events, wherein the plurality of events in the persistent data structures are stored according to a time interval; establishing a policy for identifying persistent data structures having a particular time interval that meets a threshold; not including at least a portion of a particular persistent data structure in search results for a search query when the at least a portion of the particular persistent data structure satisfies a search query and the particular persistent data structure has a time interval that meets the policy.