Abstract: A computing resource monitoring service receives a request to obtain data for various computing resources. The service obtains, from the various computing resources, one or more data log streams that include the requested data. The service utilizes the one or more data log streams to generate a probabilistic data structure that can be used to indicate that data log streams have been processed. If the one or more data log streams are not completely processed prior to the end of an allotted time period for processing of the request, the service generates a token that specifies partially processed data log streams and the probabilistic data structure. The token can be used to enable resumption of processing of the request.

Abstract: A leader host obtains individual distributions of data sets ingested by individual hosts of a fleet of hosts over a domain. The leader host compiles the individual distributions over the domain to generate a compiled distribution. The leader host then partitions the domain based at least in part on the generated compiled distribution. These partitions of the partitioned domain are distributed to individual hosts of the fleet of hosts, which causes the individual hosts to process a portion of the distributed date set according to their respective partitions.

Abstract: A technology is provided for enabling a partitioned search to be performed on log events from multiple log streams that are stored by multiple hosts. A search query may be submitted to identify the log streams whose log events are to be searched and to indicate a time interval in which log events are to have occurred as indicated by the log events' time stamps. The multiple hosts may search stored log events in parallel and return a set of log-event search results satisfying the search query. A pagination token can be included with the set of log event search results. The pagination token may be used to resume the search if the multiple hosts were not able to completely finish searching the stored log events before the set of log-event search results had to be returned to prevent a timeout of a search client.