21. An apparatus, comprising: an indexed data store; a subsystem, implemented at least partially in hardware, that receives raw data at a computing device; a subsystem, implemented at least partially in hardware, that parses the raw data into event records by determining event boundaries in the raw data, wherein each of the event records includes a portion of the raw data and is associated with a time derived from the raw data; a subsystem, implemented at least partially in hardware, that stores the event records in the indexed data store; a subsystem, implemented at least partially in hardware, that generates a summarization table that: identifies one or more field values, wherein a field value comprises a value that appears in an associated field in one or more of the event records in the indexed data store; and for each field value, identifies a set of one or more event records in the indexed data store that contain the field value for the associated field; a subsystem, implemented at least partially in hardware, that receives a query that includes search criteria for evaluating field values for one or more fields; a subsystem, implemented at least partially in hardware that uses the search criteria to evaluate field values for one or more fields in the summarization table to generate a preliminary result set; a query determination subsystem, implemented at least partially in hardware, that determines that the query cannot be answered fully by the summarization table by determining that the indexed data store includes event records that have not been processed for inclusion in the summarization table; and a subsystem, implemented at least partially in hardware that, based on determining that the indexed data store includes event records that have not been processed for inclusion in the summarization table: using the search criteria to identify supplemental event records in the indexed data store that satisfy the search criteria and that have not been processed for inclusion in the summarization table; generating a query result using the preliminary result set from the summarization table and the supplemental event records; and causing display of the query result or transmitting the query result to a second computing device for further processing and output.
21. An apparatus, comprising: an indexed data store; a subsystem, implemented at least partially in hardware, that receives raw data at a computing device; a subsystem, implemented at least partially in hardware, that parses the raw data into event records by determining event boundaries in the raw data, wherein each of the event records includes a portion of the raw data and is associated with a time derived from the raw data; a subsystem, implemented at least partially in hardware, that stores the event records in the indexed data store; a subsystem, implemented at least partially in hardware, that generates a summarization table that: identifies one or more field values, wherein a field value comprises a value that appears in an associated field in one or more of the event records in the indexed data store; and for each field value, identifies a set of one or more event records in the indexed data store that contain the field value for the associated field; a subsystem, implemented at least partially in hardware, that receives a query that includes search criteria for evaluating field values for one or more fields; a subsystem, implemented at least partially in hardware that uses the search criteria to evaluate field values for one or more fields in the summarization table to generate a preliminary result set; a query determination subsystem, implemented at least partially in hardware, that determines that the query cannot be answered fully by the summarization table by determining that the indexed data store includes event records that have not been processed for inclusion in the summarization table; and a subsystem, implemented at least partially in hardware that, based on determining that the indexed data store includes event records that have not been processed for inclusion in the summarization table: using the search criteria to identify supplemental event records in the indexed data store that satisfy the search criteria and that have not been processed for inclusion in the summarization table; generating a query result using the preliminary result set from the summarization table and the supplemental event records; and causing display of the query result or transmitting the query result to a second computing device for further processing and output. 30. The apparatus of claim 21 , wherein the summarization table includes two or more table portions, and wherein each of the two or more table portions is stored in a distributed manner proximate to a subset of the event records to which it pertains.