Abstract: In an embodiment, a method comprises processing an input data stream as the data stream is streamed and producing a derived stream therefrom; storing the input data stream in an input archive; suspending processing of the input data stream; subsequent to suspending processing, resuming processing of the input data stream, wherein resuming comprises: storing newly received data in the input data stream in a buffer, as the input data stream is streamed; determining a first timestamp; determining a second timestamp; searching the input archive to find a data item that matches the first timestamp of the last processed data item; processing data in the input archive having timestamps that are greater than the first timestamp until arriving at data with a third timestamp that is greater than the second timestamp; processing the input data stream from the buffer; continuing processing the input data stream as the input stream is streamed.

Abstract: In an embodiment, a method comprises receiving, at an analytics engine, from a separate analytics application, an analytics query for data that is potentially available in data streams of networked computing devices; sending, to a distributed network analytics controller, sub-queries based on the analytics query; determining distributed network analytics agents capable of executing each of the sub-queries; sending instructions to the agents to initiate the sub-queries for the data at specified locations; initiating execution of the sub-queries on data streams that are locally available at one of the networked computing devices at which the agents are running; forming summarized data streams and zero or more raw data streams at the networked computing devices having the analytics agents; sending the summarized data streams and the zero or more raw data streams to the analytics engine; wherein the method is performed by computing device(s).

Abstract: In an embodiment, a method comprises processing an input data stream as the data stream is streamed and producing a derived stream therefrom; storing the input data stream in an input archive; suspending processing of the input data stream; subsequent to suspending processing, resuming processing of the input data stream, wherein resuming comprises: storing newly received data in the input data stream in a buffer, as the input data stream is streamed; determining a first timestamp; determining a second timestamp; searching the input archive to find a data item that matches the first timestamp of the last processed data item; processing data in the input archive having timestamps that are greater than the first timestamp until arriving at data with a third timestamp that is greater than the second timestamp; processing the input data stream from the buffer; continuing processing the input data stream as the input stream is streamed.