3. The method of claim 1 , wherein generating at least one result further comprises: if the at least one query includes at least one of group-by expressions, perform further actions, including: generating at least one helper array; determining each lexicon record that includes at least a field name associated with each group-by expression; iterating through each posting value corresponding to each determined lexicon record based on at least one other helper array associated with the processing of a where clause; employing the at least one lexicon to determine a group-by value and a group-by bin that is associated with each posting value; if the group-by bin for the group-by value is absent, generating a new group-by bin; if the new group-by bin has a parent group-by bin, associating the new group-by bin with the parent group-by bin; projecting each posting value into the group-by bin by storing a pointer in the at least one helper array; if an aggregation function exists in the query, generating at least one aggregated result by iterating over each lexicon record that includes the at least one field name and incorporating the corresponding at least one field value into the aggregated result by using the at least one helper array to determine which group by bin to store the aggregated result; and generating each result row by traversing the group-by bins based on an order in which the group-by bins are generated.
1. A method for searching data using a network device that is operative to perform actions, comprising: storing data into at least one datastore; generating at least one field name that corresponds to at least one field value from the data; determining at least one posting value associated with the at least one field name that corresponds to the at least one field value, wherein the at least one posting value at least identifies a location of a record in the at least one datastore that includes the at least one field name that corresponds to the at least one field value; generating at least one lexicon that includes at least one lexicon record that comprises the at least one field name, the at least one field value, and the at least one posting value which correspond to each other; receiving a query directed to data stored in the at least one datastore; generating at least one result for the query based on at least a portion of the lexicon separate from the at least one datastore; if the at least one query includes at least one aggregation function, performing further actions, including: locating the at least one lexicon record for at least a first lexicon record that includes at least a field name that is associated with the at least one aggregation function; and generating at least one aggregated result by iterating over each lexicon record that includes the at least one field name and incorporating the corresponding at least one field value into the aggregated result; and projecting the at least one result into at least one row in at least one table.