1. A method, comprising: receiving event data; transforming the event data into attribute/value pairs; generating an index operable for mapping the attribute/value pairs to a pointer that points to event data which contains the attribute/value pair; and generating an attribute co-occurrence map including attribute names that co-occur together in the event data.