1. A computer implemented method, comprising: receiving raw data at a computing device; parsing the raw data into event records by determining event boundaries in the raw data, wherein each of the event records includes a portion of the raw data and is associated with a time derived from the raw data; storing the event records in an indexed data store; generating a summarization table that: identifies one or more field values, wherein a field value comprises a value that appears in an associated field in one or more of the event records in the indexed data store; and for each field value, identifies a set of one or more event records in the indexed data store that contain the field value for the associated field; receiving a query that includes search criteria for evaluating field values for one or more fields; using the search criteria to evaluate field values for one or more fields in the summarization table to generate a preliminary result set; determining that the query cannot be answered fully by the summarization table by determining that the indexed data store includes event records that have not been processed for inclusion in the summarization table; and based on determining that the indexed data store includes event records that have not been processed for inclusion in the summarization table: using the search criteria to identify supplemental event records in the indexed data store that satisfy the search criteria and that have not been processed for inclusion in the summarization table; generating a query result using the preliminary result set from the summarization table and the supplemental event records; and causing display of the query result or transmitting the query result to a second computing device for further processing and output.