1. A method, comprising: receiving a query including a criterion for searching a set of events stored across a plurality of distributed machines, wherein each distributed machine has responsibility to search a time-based subgroup of the set of events, wherein each distributed machine has responsibility to search a time-based subgroup different than time-based subgroups that other distributed machines have responsibility to search, and wherein each event in the set of events is associated with a timestamp; in response to receiving the query, directing at least a portion of the plurality of distributed machines to search, in respective time-based subgroups, for events responsive to the query; receiving from the distributed machines information relating to values for a field that are in the events responsive to the query; aggregating the received information to determine a number corresponding to how many unique values exist for the field in the events responsive to the query; displaying the number corresponding to how many unique values exist for the field; wherein the method is performed by one or more computing devices.