6. A system that builds a searchable data store, comprising: a processor and memory coupled to the processor, the memory storing program instructions that when executed cause: electronically receiving machine data produced by devices in an information processing environment; segmenting the machine data into a plurality of events by determining a beginning and ending of each event in the plurality of events in the machine data; associating a time stamp with each event in the plurality of events by applying an extraction rule to the machine data segmented for each event in order to extract time information to use as the time stamp for that event; repeatedly generating buckets in volatile, random access memory; designating a time span for each bucket of the generated buckets; inserting a time stamped event in the plurality of events into a particular bucket in the generated buckets based at least in part on the associated time stamp and the time span of the particular bucket; advancing a full bucket to full bucket status that does not accept further events; transferring the full bucket into non-volatile storage, the full bucket is available for searching; determining that a full bucket in non-volatile storage has expired; and based on determining that the full bucket has expired, moving the full bucket out of active status.
6. A system that builds a searchable data store, comprising: a processor and memory coupled to the processor, the memory storing program instructions that when executed cause: electronically receiving machine data produced by devices in an information processing environment; segmenting the machine data into a plurality of events by determining a beginning and ending of each event in the plurality of events in the machine data; associating a time stamp with each event in the plurality of events by applying an extraction rule to the machine data segmented for each event in order to extract time information to use as the time stamp for that event; repeatedly generating buckets in volatile, random access memory; designating a time span for each bucket of the generated buckets; inserting a time stamped event in the plurality of events into a particular bucket in the generated buckets based at least in part on the associated time stamp and the time span of the particular bucket; advancing a full bucket to full bucket status that does not accept further events; transferring the full bucket into non-volatile storage, the full bucket is available for searching; determining that a full bucket in non-volatile storage has expired; and based on determining that the full bucket has expired, moving the full bucket out of active status. 9. The system of claim 6 , further configured to index keywords in the events in the particular bucket.