1. A method for building a searchable data store, comprising: repeatedly generating buckets in memory to receive events, designating time spans of events in respective buckets, and maintaining a record of designated time spans assigned to respective buckets for time keyed event retrieval; electronically receiving machine data, including textual data, produced by devices in an information processing environment, separating the machine data into events at boundaries between contiguous portions of the machine data, applying time stamps to the events, and inserting a respective event into a respective bucket based at least in part on a respective applied time stamps and the time spans of the respective buckets; wherein the respective bucket receiving the respective event is in non-volatile random access memory; and advancing a filled respective bucket to full bucket status that does not accept further events; and transferring at least of the filled buckets into non-volatile storage.