STORING LOG DATA AS EVENTS AND PERFORMING A SEARCH ON THE LOG DATA AND DATA OBTAINED FROM A REAL-TIME MONITORING ENVIRONMENT

摘要

Methods and apparatus consistent with the invention provide the ability to organize, index, search, and present time series data based on searches. Time series data are sequences of time stamped records occurring in one or more usually continuous streams, representing some type of activity. In one embodiment, time series data is stored as discrete events time stamps. A search is received and relevant event information is retrieved based in whole or in part on the time stamp, a keyword indexing mechanism, or statistical indices calculated at the time of the search.