1. A method executed by a computer, comprising: receiving a report search query from one more event data collectors; parsing the report search query to determine a specified attribute of an event being searched; retrieving values or statistics associated with the specified attribute; determining a co-occurring attribute of the specified attribute; aggregating at least one of values or statistics associated with the co-occurring attribute; and generating a report that includes at least one of the values or statistics associated with the co-occurring attribute, wherein generating the report comprises: projecting event data in a log file into one or more attribute/value pairs, including generating the attribute/value pairs based on a message type of the event data, the message type being determined by a signature of the event data; and determining the statistics on the co-occurring attribute using a combination of: an attribute co-occurrence data structure identifying a relationship between the specified attribute and the co-occurring attribute; and an index mapping each of the one or more attribute/value pairs to an inverted reference pointer referencing an instance of the event data, the instance of event data including a raw log message corresponding to the respective attribute/value pair.