1. A method comprising: identifying a plurality of files to process based on a received query; identifying a plurality of execution nodes available to process the plurality of files; initially creating a plurality of scansets and assigning each of the scansets to one of the plurality of execution nodes based on a file assignment model, wherein each scanset includes a portion of the plurality of files; processing the multiple scansets by the plurality of execution nodes; determining whether a particular execution node has finished processing all files in its assigned scanset; and responsive to determining that a particular execution node has finished processing all files in its assigned scanset: reassigning an unprocessed file from a second execution node; and assigning the unprocessed file to the particular execution node for processing.