DISPLAY FOR A NUMBER OF UNIQUE VALUES FOR AN EVENT FIELD

摘要

A method, system, and processor-readable storage medium are directed towards generating a report derived from data, such as event data, stored on a plurality of distributed nodes. In one embodiment the analysis is generated using a “divide and conquer” algorithm, such that each distributed node analyzes locally stored event data while an aggregating node combines these analysis results to generate the report. In one embodiment, each distributed node also transmits a list of event data references associated with the analysis result to the aggregating node. The aggregating node may then generate a global ordered list of data references based on the list of event data references received from each distributed node. Subsequently, in response to a user selection of a range of global event data, the report may dynamically retrieve event data from one or more distributed nodes for display according to the global order.

主权项

1. A method, comprising:
receiving a query for searching a set of field searchable events stored in a data store; executing the query against the set of field searchable events to generate a subset of events; identifying a field that exists in one or more events of the subset of events; determining a number corresponding to how many unique values exist for the field among the subset of events; causing display of the number corresponding to how many unique values exist for the field along with a field name by which the field can be referenced in a query; wherein the method is performed by one or more computing devices.