Abstract: A first stream of first data records, each including one or more first values describing an event, and a second stream of second data records, each including one or more second values describing an event, are received from respective data sources. Each first data record is stored in an in-memory database with a timestamp. For each second data record, the in-memory database is queried for a matching first data record that likely describes the same event as does the second data record, by virtue of the timestamp of the matching first data record being later than a predefined threshold time, and at least some of the second values in the second data record matching corresponding first values in the matching first data record. An output is communicated based on a combination of the second values in the second data record with the first values in the matching first data record.