Abstract: A query pipeline is created (514) from a query request. The query pipeline includes multiple query operations including multiple query operators. A first query operator and a second query operator perform first and second query operations on a database (526) and on data outside the database (534). A result from the first query operation in the query pipeline is fed to the second query operation in the query pipeline.

Abstract: A data storage system includes a partitioning module to partition data across multiple dimensions simultaneously. The partitioning may be based on a sizing parameter for each dimension. The partitioning module stores a cluster including the partitioned event data and metadata including attributes identifying the cluster.

Abstract: A distributed event processing method includes providing a plurality of connectors. Each provided connector is configured to acquire event data from an assigned data source, partition acquired event data into clusters, and divide each cluster into chunks. The method also includes collecting the chunks from the plurality of connectors and storing the chunks to a data file that can be queried.

Abstract: A data storage system includes a storage engine to partition data across multiple dimensions. The storage engine determines chunks according to the partitioning, and performs column-based storage of the chunks.

Abstract: A method of utilizing a node power architecture (NPA) system, the method includes receiving a request to create a client, determining whether a resource is compatible with the request, and returning a client handle when the resource is compatible with the request.

Abstract: In a portable computing device having a node-based resource architecture, a first or distributed node controlled by a first processor but corresponding to a second or native node controlled by a second processor is used to indirectly access a resource of the second node. In a resource graph defining the architecture each node represents an encapsulation of functionality of one or more resources, each edge represents a client request, and adjacent nodes represent resource dependencies. Resources defined by a first graph are controlled by the first processor but not the second processor, while resources defined by a second graph are controlled by the second processor but not the first processor. A client request on the first node may be received from a client under control of the first processor. Then, a client request may be issued on the second node in response to the client request on the first node.

Abstract: A query pipeline is created (514) from a query request. The query pipeline includes multiple query operations including multiple query operators. A first query operator and a second query operator perform first and second query operations on a database (526) and on data outside the database (534). A result from the first query operation in the query pipeline is fed to the second query operation in the query pipeline.

Abstract: In a portable computing device having a node-based resource architecture, a first or distributed node controlled by a first processor but corresponding to a second or native node controlled by a second processor is used to indirectly access a resource of the second node. In a resource graph defining the architecture each node represents an encapsulation of functionality of one or more resources, each edge represents a client request, and adjacent nodes represent resource dependencies. Resources defined by a first graph are controlled by the first processor but not the second processor, while resources defined by a second graph are controlled by the second processor but not the first processor. A client request on the first node may be received from a client under control of the first processor. Then, a client request may be issued on the second node in response to the client request on the first node.

Abstract: A method of utilizing a node power architecture (NPA) system, the method includes receiving a request to create a client, determining whether a resource is compatible with the request, and returning a client handle when the resource is compatible with the request.

Abstract: A logging system includes an event receiver and a storage manager. The receiver receives log data, processes it, and outputs a column-based data “chunk.” The manager receives and stores chunks. The receiver includes buffers that store events and a metadata structure that stores metadata about the contents of the buffers. Each buffer is associated with a particular event field and includes values from that field from one or more events. The metadata includes, for each “field of interest,” a minimum value and a maximum value that reflect the range of values of that field over all of the events in the buffers. A chunk is generated for each buffer and includes the metadata structure and a compressed version of the buffer contents. The metadata structure acts as a search index when querying event data. The logging system can be used in conjunction with a security information/event management (SIEM) system.