Abstract: Aspects of the present disclosure relate to ingesting event data into a discoverable event stream using a common schema to assign timeseries properties to the event data. These techniques may include receiving a first event of a pre-processed event stream, the first event including a plurality of event data fields representing an occurrence of the first event, and determining timing information based on the plurality of event data fields representing the occurrence of the first event. In addition, the techniques may include generating, based on combining the plurality of event data fields and the timing information, a second event of a discoverable event stream corresponding to the pre-processed event stream, and generating, within a time series of the discoverable event stream, based on the timing information and an event field of the plurality of event data fields, a time series entry corresponding to the second event.

Abstract: Described are examples for managing event data from multiple event data sources including executing, by a processor, a query for event data in a discoverable event stream, wherein the event data is stored as timeseries data in the discoverable event stream such that a property corresponding to an object has multiple different values at multiple different time instances, determining, based on a timeseries function, a subset of the multiple different values for the property in instances of the event data that correspond to the multiple different time instances to return for the query, and returning the subset of the multiple different values for the property for the query.