Abstract: Techniques for build recovery from inter-code commit failure. A build error for a software project is identified. A first software module, with one or more errors related to the build error, is selected. A comparison software module for the first software module is identified. The comparison software module includes at least one of: (i) a sibling software module to the first software module or (ii) an earlier version of the first software module. A potential problem with the first software module, related to the build error, is determined based on comparing the first software module with the comparison software module. A solution to the potential problem is generated based on the first software module. The solution includes a modification to the software code of the first software module. The solution is applied by modifying the software code of the first software module.

Abstract: A system for extending functionality of a computer programming language includes a programming interface, a module creator, an object creator, and a node compiler, all executing on a computer. The programming interface provides a code editor. The module creator defines a module based on user input received via the code editor. The module exports a function with a plurality of sub-functions, including a first sub-function and a second sub-function. The object creator defines a plurality of versions of an object based on user input received via the code editor, including a first version having a call for the function to take as an argument a first node including a first parameter linked to the first sub-function and a second node including a second parameter linked to the second sub-function. The node compiler detects a dependency between the first node and the second node.

Abstract: Some embodiments provide a novel method for collecting and reporting attributes of data flows associated with machines executing on a plurality of host computers to an analysis appliance. Some embodiments collect, each time a request for a new data message flow is initiated, a set of contextual attributes (i.e., context data) associated with the requested new data message flow. The method, in some embodiments, generates a correlation data set and provides the correlation data set to be included in flow data regarding the requested data message flow to be used by the analysis appliance to correlate context data and flow data received as separate data sets from multiple host computers.

Abstract: Instrumentation codes are inserted into predetermined portions of a bytecode. Every transaction referenced in the bytecode is virtually combined and arranged hierarchically to describe a virtual transaction stack describing the computer-based resources accessed during the transaction. Based at least on the origin of the transaction, the characteristics of the transaction and the computer-based resources accessed during the transaction, the sensitivity of the transaction, and the security context of each of the computer-based resources accessed during the transaction are determined. A policy store is searched for at least one access control policy referencing the transaction, or the computer-based resources requested accessed by the transaction. If such an access control policy is found, it is selectively modified to refer exclusively to the transaction and the corresponding sensitive computer-based resources.

Abstract: A system and method of forming proxy server pools is provided. The method comprises several steps, such as requesting a pool to execute the user's request and retrieving an initial group. The system checks the service history of an initial group, including whether any of the proxy servers in an initial group are exclusive to existing pools. The exclusive proxy servers in an initial group with eligible proxy servers are replaced when needed and new proxy server pools are formed. The system also records the service history of proxy servers and pools before and after the pools are created. The method can also involve predicting the pool health in relation with the thresholds foreseen and replacing the proxy servers below the threshold.

Abstract: Systems and methods for version control of pipelined enterprise software are disclosed. Exemplary implementations may: store information for executable code of software applications that are installed and executable by users, receive first user input from a first user that represents selection by the first user of a first software pipeline for execution; receive second user input from a second user that represents a second selection by the second user of a second software pipeline for execution, wherein the second software pipeline includes different versions of software applications that are included in the first software pipeline; facilitate execution of the first software pipeline for the first user; and facilitate execution of the second software pipeline for the second user at the same time as the execution of the first software pipeline for the first user.

Abstract: Embodiments for program optimization are provided. A program is compiled with respect to a performance result utilizing a set of parameters. Information associated with the compiling of the program is collected. The collected information is external to the performance result. The set of parameters is changed based on the collected information.

Abstract: Systems and methods for analyzing input data records are provided in which a master process initiates a plurality of concurrent first processes each of which comprises, for each data record in at least a subset of a plurality of input data records, creating a parsed representation of the data record and independently applying a procedural language query to the parsed representation to extract one or more values. A respective emit operator is applied to at least one of the extracted one or more values thereby adding corresponding information to a respective intermediate data structure. The respective emit operator implements one of a predefined set of statistical information processing functions. The master process also initiates a plurality of second processes each of which aggregates information from a corresponding subset of intermediate data structures to produce aggregated data that is, in turn, combined to produce output data.

Abstract: A method of analyzing a performance of a microservices-based application comprises generating a plurality of traces from a plurality of spans associated with the microservices-based application. The method also comprises generating a plurality of data sets each associated with a respective analysis mode of a plurality of analysis modes using the plurality of traces, wherein each analysis mode extracts a different level of detail for analyzing the performance of the services in the application from the plurality of spans. Further, the method comprises selecting, based on a first user query, a first analysis mode from the plurality of analysis modes for generating a response to the first user query. The method also comprises accessing a data set of the plurality of data sets that is associated with the first analysis mode and generating the response to the first user query using the data set associated with the first analysis mode.

Abstract: An embodiment includes requesting, by a compiler responsive to execution of a first code segment, a first profile dataset associated with the first code segment. The embodiment also includes executing, responsive to receiving an indication that the first profile dataset is not available, a querying process that searches other code segments based on specified criteria relating to an attribute of the first code segment. The embodiment also includes receiving a search result from the querying process, where the search result includes a second code segment. The embodiment also includes generating an extrapolated profile dataset based at least in part on the second code segment. The embodiment stores the extrapolated profile dataset in memory associated with the first code segment, and the compiler performs an optimization process on the first code segment using the extrapolated profile dataset.

Abstract: The present invention relates to a method for automatically analyzing a bottleneck in real time and an apparatus for performing the method. The method for automatically analyzing a bottleneck in real time may comprise the steps of: an application server receiving a bottleneck analysis component; and the application server installing the bottleneck analysis component, wherein the bottleneck analysis component may add a call code for a performance information collector to an application installed on the application server that is to be monitored, wherein the bottleneck analysis component may call the performance information collector according to execution of a service function of the application, requested by a client, to generate service performance information for analyzing a bottleneck phenomenon.

Abstract: Methods, systems, and computer-readable media for refinement of static analysis of program code are disclosed. A report is received. The report was generated using initial static analysis of program code. The report indicates a plurality of warnings regarding the program code, at least some of which represent potential flaws, and the warnings are associated with a plurality of segments of the program code. Additional analysis of the segments of program code is performed. The additional analysis differs at least in part from the initial static analysis. Based at least in part on the additional analysis, at least some of the warnings are determined to represent false positives.

Abstract: A system for generating a minimum working example (MWE) of the source code of a computer program is provided. The system receives the source code and executes the computer program. The system encounters a runtime error and obtains a stack trace from the execution of the computer program. The stack trace identifies runtime errors and the code segments that were executed that led to the runtime error. The system uses the stack trace to identify one or more variables that affect a most recently executed segment of the source code when the runtime error occurred. The system identifies one or more segments of the source code that do not affect the identified relevant variables. The system generates an MWE of the source code by pruning the identified one or more segments from the source code.

Abstract: A generation apparatus includes a memory configured to store variable value information indicating variable value candidates for each variable name, and a processor configured to generate a first machine language instruction corresponding to a first code in response to receiving designation of the first code included in codes generated by a compiler, and when the generated first machine language instruction includes a variable name of a specific type, by reference to the variable value information stored in the memory, perform generation of a plurality of machine language instructions based on a plurality of pieces of variable value information associated with each of one or more variable names included in the generated first machine language instruction.

Abstract: A wide variety of software support functionality can be improved via error incident fingerprinting with unique static identifiers. Such unique identifiers can originate within an integrated development environment and be propagated to runtime, where they can be harvested from execution context at the time of an error. The fingerprint created from such a unique identifier can then be used for a variety of purposes, including indexing knowledge base records, criticality detection, service innovation, alerting, incident resolution, impacts to the development process, and machine learning.

Abstract: A system and methods for efficiently injecting probes to executable code, which is then executed. Such probes may be used for example to examine the behavior of the code during execution. Optionally analyzing the behavior of the code during execution is used as part of a testing strategy for the code.

Abstract: Embodiments for generating representative microbenchmarks in a computing environment are provided. One or more tracing points may be selected in a target application. Executed instructions and used data of the target application may be dynamically traced according to the one or more tracing points according to a tracing plan. Tracing information of the dynamic tracing may be replicated in an actual computing environment and a simulated computing environment.

Abstract: Runtime statistics from the actual performance of operations on a set of data are collected and utilized to dynamically modify the execution plan for processing a set of data. The operations performed are modified to include statistics collection operations, the statistics being tailored to the specific operations being quantified. Optimization policy defines how often optimization is attempted and how much more efficient an execution plan should be to justify transitioning from the current one. Optimization is based on the collected runtime statistics but also takes into account already materialized intermediate data to gain further optimization by avoiding reprocessing.

Abstract: Disclosed herein are embodiments of systems, methods, and products for modernizing and optimizing legacy software. A computing device may perform an automated runtime performance profiling process. The performance profiler may automatically profile the legacy software at runtime, monitor the memory usage and module activities of the legacy software, and pinpoint/identify a subset of inefficient functions in the legacy software that scale poorly or otherwise inefficient. The computing device may further perform a source code analysis and refactoring process. The computing device may parse the source code of the subset of inefficient functions and identify code violations within the source code. The computing device may provide one or more refactoring options to optimize the source code. Each refactoring option may comprise a change to the source code configured to correct the code violations. The computing device may refactor the source code based on a selected refactoring option.

Abstract: A system for providing an API-driven continuous test platform is disclosed. The system may include one or more processors, a test engine, one or more test agents, and a database. The system may prepare (according to a configuration file) a first test configuration comprising a first selection of the one or more test agents, execute (using the test engine) the first test configuration to produce one or more first test results, and store (using the database) the one or more first test results. Finally, the system may process (using a continuous integration and continuous delivery (CI/CD) pipeline) the first test results by performing at least one of the following CI/CD processes: updating a central code base of an enterprise production environment, rejecting at least one code snippet processed by the test engine during execution of the first test configuration, and marking the first test results as inconclusive.

Abstract: A method for efficient end-to-end monitoring of massive transactions related to a monitored system including at least one web server, and at least one web application server is provided. The method includes steps of: (a) a trace information inputting device performing a process of instructing the web server and the web application server included in the monitored system to generate each of multiple pieces of individual trace information including transaction identification information and transaction sequence information; and (b) if the multiple pieces of the individual trace information, including the transaction identification information and the transaction sequence information, are acquired from the web server and the web application server, the trace information inputting device performing a process of storing the multiple pieces of the individual trace information in a trace information storing unit.

Abstract: Disclosed herein are embodiments of systems, methods, and products comprise a processor, which provides runtime enforcement of data flow integrity. The processor accesses the application binary file from the disk to execute an application and translates the application binary into intermediate representation. The processor applies the logic of data flow integrity controls to the intermediate representation. Specifically, the processor identifies the vulnerable code in the intermediate representation. The processor applies data flow integrity controls to the vulnerable code. The processor adds simple instrumentation that only changes the application's behavior when unauthorized data tampering occurs while preserving the application's normal behavior. When certain operations may cause unauthorized data tampering, the processor takes proper measures to stop the operations. The processor translates the intermediate representation back to a machine code and replaces the original binary with the machine code.

Abstract: Techniques for resource allocation are described. Some embodiments provide a resource allocation manager configured to dynamically allocate physical computing resources amongst multiple virtual machines hosted on a physical computing system. The resource allocation manager receives information about the importance of activities that can occur on the multiple virtual machines. Activities may include or be based on virtual machine states, virtual desktop states, business activities or processes performed by users, or the like. Then, the resource allocation manager determines that an activity is occurring on one of the virtual machines. In response, the resource allocation manager reallocates physical computing resources of the physical computing system that are assigned or available to the one virtual machine, based on the occurring activity and its corresponding importance.

Abstract: One example method includes receiving a generation 0 data stream, creating and/or receiving a mask that includes multiple entries, each of which corresponds to a respective block of the generation 0 data stream, and each mask entry indicating a value n (0<=n<=desired generation N), identifying, in the mask, all non-zero entries, locating, in the generation 0 data stream, the blocks to which this entry corresponds to and based on the value n, modifying the generation 0 block to generate a generation N data stream.

Abstract: One embodiment illustrated herein includes a method that may be practiced in a computing environment with a guest architecture running a native architecture system. The method includes acts for handling function calls. The method includes receiving a call to a hybrid binary, wherein the call is in a format for the guest architecture. The hybrid binary includes a native function compiled into a native architecture binary code using guest architecture source code, an interoperability thunk to handle an incompatibility between the guest architecture and the native architecture, and native host remapping metadata that is usable by an emulator to redirect native host callable targets to the interoperability thunk. The method further includes invoking the interoperability thunk to allow the native function in the hybrid binary to be executed natively on the native architecture system.

Abstract: A method may be performed by a network server and includes: applying historical raw user data as an input to a first application running in a simulation environment; receiving activity log entries from the first application in the simulation environment; identifying a first group of the activity log entries corresponding to an error of the first application; saving an error entry in non-volatile storage media in response to identifying the first group of the activity log entries, the error entry including the first group of the activity log entries and an identification of action to be taken in response to the error of the first application; and causing a monitoring system to generate a first alert corresponding to the error entry.

Abstract: Particular embodiments described herein provide for an electronic device that can be configured to help with the identification of a no-operation (NOP) sled attack identify. The system can be configured to receive an instruction, increment a value in a total instruction counter, increment a value in a branch instruction counter when the instruction is a branch instruction, increment a value in a memory instruction counter when the instruction is a memory instruction, create a ratio based on the value in the total instruction counter and the value in the branch instruction counter or the value in the memory instruction counter, and trigger an alert when the ratio satisfies a threshold. The ratio can indicate the presence of a NOP sled attack and the alert can be an interrupt that stops execution of the NOP sled.

Abstract: A method of automatically cross-referencing problem information between users, comprising: monitoring, via a network, problems in one of a plurality of software programs, each executed on one of a plurality of client terminals; storing in a problems dataset a plurality of problem entries, each containing problem information of at least one of the problems; detecting a new problem occurring in a first client terminal of the plurality of client terminals; analyzing the new problem to identify at least one similar problem in the problems dataset based on the problem information; and presenting an indication of the at least one similar problem to assist in eliminating said new problem.

Abstract: The present invention relates to a method for automatically monitoring end-to-end end user performance and an apparatus for performing the method. The method for automatically monitoring end-to-end end user performance comprises the steps of: an application server receiving a performance analysis component; and an application server installing the performance analysis component, wherein the performance analysis component may add a monitoring script to a reply by an application to service a hypertext markup language (HTML) page with a web browser, wherein the monitoring script may collect and provide end user performance monitoring information relating to an event generated from the HTML page.

Abstract: A computer-implemented method, computer program product, and system is provided for determining test coverage. In an implementation, a method may include identifying at least one change in source code. The method may also include instrumenting object code of at least one class file associated with a source file of the source code associated with the identified at least one change. The method may further include testing the instrumented object code with at least one test case. The method may further include generating a coverage report associated with the instrumented object code, wherein the coverage report includes a proportion of the at least one change in the source code covered by the at least one test case.

Abstract: Calling a function may include: determining whether a call is a direct or an indirect call. In response to determining that the call is an indirect call, a first address stored in a function pointer may be obtained, wherein the function pointer is stored at a first address in a stack frame of a calling function. Whether to execute a nested function call code sequence may be determined based on whether a tag bit in the first address stored in the function pointer is set. In response to determining that the tag bit in the first address is set, a second address stored at a nested function address location may be obtained, wherein the nested function address location is at the first address, and control may be transferred to a called function, wherein the called function is stored at the second address.

Abstract: An initial workspace recommendation engine recommends a user interface component available for inclusion in an initial workspace of a newly installed application instance. In some cases, a classifier included in the engine classifies the available user interface component based on data describing multiple previously installed instances of the application. For example, the multiple instances are installed on multiple user devices, and are associated with user features describing the installed instances. In addition, the initial workspace recommendation engine receives a set of new user features associated with the newly installed application instance. The classifier classifies the available user interface component based on a similarity between the new user features and the user features describing the installed instances.

Abstract: Provided are integrated circuit devices and methods for operating integrated circuit devices. In various examples, an integrated circuit device can include a memory for storing instructions a configuration register, and an instruction execution circuit. An instruction read from the memory can be a reconfigurable instruction. which includes a set of fields corresponding to a plurality of operations. Values in the fields can determine whether the operations are enabled or disabled. For example, a first value in a first field can enable a first operation. Whether the first operation is performed can further be determined by comparing a second value in a second field to a third value read from the configuration register. The value set in the configuration register thus can control whether the operation is performed.

Abstract: The present disclosure provides a method for invoking a component, comprising sending the fourth number of times, the first running time, the second number of times and the third number of times to the server, respectively; obtaining the coefficient of the second component invoking the first component from the server; receiving a request that the second component request to invoke the first component, prohibiting the request in response to that the coefficient is less than a preset threshold. The present disclosure also provides a method for calculating a coefficient, a device, an invoking component device, a storage medium, a server and a terminal.

Abstract: Techniques to facilitate modifications to program execution in an application at runtime are disclosed herein. In at least one implementation, a copy of a code block associated with code is created. A flag associated with the copy of the code block is modified to mark the copy of the code block as having a native code version of the code. Metadata associated with the copy of the code block is modified to identify alternative code to run instead of the native code version of the code. A pointer associated with the code block is modified to point to a trampoline function. The trampoline function checks whether the code block is associated with a modification, and when the code block is associated with the modification, then the trampoline function calls the copy of the code block to invoke the alternative code by virtue of the flag and the metadata.

Abstract: A method for data communication in a virtualized environment is disclosed as follows. A write function of a graphics driver is called by a graphics processing program using a graphics processing interface, where a function in a call process is recorded in a function stack; an entry address of a write function of the graphics processing interface is determined according to an entry address of the write function of the graphics driver and a quantity of layers of the function stack, and an offset and a length that are of a vertex buffer of the graphics processing program are read from the entry address of the write function of the graphics processing interface, so as to determine a data area that is modified by the graphics processing program and is in the vertex buffer, where the modified data area is data necessary for graphics rendering.

Abstract: The current document is directed to automated application-release-management facilities that, in a described implementation, coordinate continuous development and release of cloud-computing applications. The application-release-management process is specified, in the described implementation, by application-release-management pipelines, each pipeline comprising one or more stages, with each stage comprising one or more tasks. The currently described methods and systems check whether endpoints and external tasks are reachable prior to initiating execution of application-release-management pipelines. Automatic reachability checking is scheduled for idle intervals, when the workflow-execution-engine component of the automated application-release-management facility is not executing release pipelines.

Abstract: Mechanisms are provided for generating a new compilable program from an instruction trace. The mechanisms receive a trace file for an original program whose execution on computing hardware has been traced and perform analysis of the trace file to identify a hot function, symbol information corresponding to the hot function, and initialization parameters for the hot function. The mechanisms generate a trace control flow graph based on the identified hot function and the symbol information corresponding to the hot function. The mechanisms identify, based on the trace control flow graph, pathways in the original program to the hot function, represented in the trace file. The mechanisms generate a reconstructed program based on the trace control flow graph, the pathways to the hot function, and the initialization parameters, and output the reconstructed program.

Abstract: Technology for dynamically adjusting a process scheduler in a storage processor of a data storage system. An average amount of host data contained in sets of host data processed by host I/O request processing threads is calculated. An average amount of time required for each host I/O request processing thread to execute to completely process the average amount of host data contained in a set of host data is also calculated. Operation of the process scheduler in the storage processor is then adjusted to cause the process scheduler to subsequently allocate the processor in the storage processor to host I/O request processing threads in timeslices having a duration that is at least as large as the average amount of time required for each host I/O request processing thread to execute to completely process the average amount of host data contained in a set of host data.

Abstract: A system for automatic buffer overflow warning inspection and bug repair is disclosed. The system includes a first module for warning reachability analysis, the first module accepts static overflow warnings and source code as an input, the first module is functionally connected to the second and the third modules, and sends out a warning path set as an output. The system also includes a second module for guided symbolic execution, the second module is functionally connected to the first module and the third module. The system further includes a third module for buffer overflow validation, the third module is functionally connected to the first, the second and the four modules and sends out undecided warnings and false warnings as output. The system further includes a fourth module for targeted automatic repair, the fourth module is functionally connected to the third module and sends out true warnings as output.

Abstract: A context aware mobile personalization system is disclosed for a software development environment with plug-in capabilities for providing personalized phone capabilities based on the automated detection of user context.

Abstract: The present disclosure involves systems and computer-implemented methods for installing software hooks. One process includes identifying a target method and a hook code, where the hook code is to execute instead of at least a portion of the target method, and wherein the target method and the hook code are executed within a managed code environment. A compiled version of the target method and a compiled version of the hook code are located in memory, where the compiled versions of the target method and the hook code are compiled in native code. Then, the compiled version of the target method is modified to direct execution of at least a portion of the compiled version of the target method to the compiled version of the hook code. The non-compiled version of the target method may be originally stored as bytecode. The managed code environment may comprise a managed .NET environment.

Abstract: Method and systems of visually depicting instrumented and sampled data are provided. A first stream of instrumented data, the instrumented data collected via execution of code contained in a user-scriptable engine. Then a second stream of sampled data is received, the sampled data collected by monitoring execution of code contained in scripts executed by the user-scriptable engine. Then an aggregated version of a portion of the instrumented data and an aggregated version of a portion of the sampled data are simultaneously displayed in one or more viewing regions. Then user interaction with an object pertaining to the aggregated version of a portion of the instrumented data is received. In response to the receiving user interaction with the object pertaining to the aggregated version of a portion of the instrumented data, the aggregated version of the portion of the sampled data is caused to change to depict a different aggregated version of a portion of the sampled data.

Abstract: A method and system for testing performance of a software product. One or more complete executions of a performance test of corresponding versions of the software product are performed. The complete executions of the performance test identifies a steady state value of each performance parameter monitored during the performance test after each performance parameter has transitioned to a steady state during the performance test. A performance profile of the software product is determined according to the complete executions of the performance test. Partial executions of the performance test of corresponding further versions of the software product are performed, each partial execution having a partial duration preceding the steady state of each performance parameter. Corresponding results of the partial executions of the performance test are estimated according to the performance profile from corresponding partial trends of each performance parameter during the partial executions of the performance test.

Abstract: A build indicator is set in a build environment to a set value for building a program code, the set value selected from a first value indicating that a feature of the program code is enabled, and a second value indicating that the feature is disabled. In response to the set value of the build indicator being the first value, a variable is set to a value indicating that the feature is enabled. The program code is built using the value of the variable.

Abstract: In one aspect, a computerized method utilizing an interoperable cloud Domain-specific language (DSL) to orchestrate multiple cloud platforms and services including the step of parsing one or more DSL inputs. The computerized method includes the step of validating one or more DSL inputs a content and a syntax based on a DSL type and a type of associated cloud platform. The computerized method includes the step of chaining the one or more DSL to orchestrate resources in various cloud platforms by using cloud-platform native DSL and with orchestrating operational tools using third party custom DSLs. The computerized method includes the step of parsing an input data structure from the one or more DSLs together. The computerized method includes the step of appending the input data structure from the one or more DSLs together to capture input values together for execution.

Abstract: A system for hierarchical cooperative computing is provided, comprising a vector definition service configured to receive a user-submitted request, and compile the request into a vector; a rules engine configured to retrieve the vector from the vector definition service, and evaluate the vector for appropriateness; a parametric evaluator configured to parameterize the vector, and generate at least a run from the parameterized vector; and an optimizer configured to retrieve the run from the parametric evaluator, and determine an optimal plan for executing the user-submitted request.

Abstract: A processor circuit and an operation method thereof are provided. The processor circuit includes a re-order buffer (ROB) and an alias queue (AQ) module. The ROB records next sequential instruction pointer (Nsip) values of a plurality of load instructions and a plurality of store instructions. Each of a plurality of entries of the AQ module includes a first field and a plurality of second fields. When a first load instruction and a first store instruction cause a first memory violation and the ROB retires the first load instruction, the AQ module stores the Nsip value of the first load instruction into the first field of one of the entries and stores the Nsip value of the first store instruction into one of the second fields of one of the entries.

Abstract: A system is provided to run new code modules safely in a duplicative, protected environment without affecting the code modules that are already trusted to be on the system. The system receives a new code module that validates operational data of a computing device, and instantiates a new, parallel execution engine to run the new code module on the operational data in parallel with another execution engine running the trusted/verified code modules that also validate the same operational data. The new engine runs the new code module with the operational data to produce new code module results. The production engine runs the trusted/verified code modules with the operational data to produce verified code module results. The new code module results are combined with the verified code module results to produce combined results describing the operational status of the computing device.

Abstract: Embodiments of the present disclosure provide techniques for using an inverted index in a pipelined search query. A field searchable data store is provided that comprises a plurality of event records, each event record comprising a time-stamped portion of raw machine data. Responsive to the reciept of an incoming search query, the search engine accesses an inverted index, wherein each entry in the inverted index comprises at least one field name, a corresponding at least one field value and a reference value associated with each field name and value pair that identifies a location in the data store where an associated event record is stored. Once the inverted index is accessed, it can be used to filter out a subset of the plurality of event records, wherein the subset comprises one or more event records with corresponding reference values in the inverted index.