11. A network device comprising: a transceiver that is operative to communicate over a network; a memory that is operative to store at least instructions; and a processor device that is operative to execute instructions that enable actions, including: providing a datastore comprising a plurality of time-stamped, searchable events, each event having a portion of raw data and a timestamp extracted from the portion of raw data, the portion of raw data produced by at least one hardware system; providing a data structure that contains a plurality of field names, each field name among the plurality of field names associated with a set of pointers to time-stamped, searchable events having a value for a field referred to by the field name; receiving an incoming search query that references one or more field names among the plurality of field names contained in the data structure and a time range criteria; and in response to the incoming search query, servicing the incoming search query by: (i) executing the incoming search query across the data structure, wherein one or more values from the data structure are used to create a search result; and (ii) supplementing the search result by executing a search comprising the time range criteria of the incoming search query across the time-stamped searchable events, independent of the data structure.
11. A network device comprising: a transceiver that is operative to communicate over a network; a memory that is operative to store at least instructions; and a processor device that is operative to execute instructions that enable actions, including: providing a datastore comprising a plurality of time-stamped, searchable events, each event having a portion of raw data and a timestamp extracted from the portion of raw data, the portion of raw data produced by at least one hardware system; providing a data structure that contains a plurality of field names, each field name among the plurality of field names associated with a set of pointers to time-stamped, searchable events having a value for a field referred to by the field name; receiving an incoming search query that references one or more field names among the plurality of field names contained in the data structure and a time range criteria; and in response to the incoming search query, servicing the incoming search query by: (i) executing the incoming search query across the data structure, wherein one or more values from the data structure are used to create a search result; and (ii) supplementing the search result by executing a search comprising the time range criteria of the incoming search query across the time-stamped searchable events, independent of the data structure. 13. The network device of claim 11 , wherein the processor device is further operative to execute instructions that enable actions, comprising: sorting the pointers in each set of pointers associated with a field name based on a stored position of the associated time-stamped, searchable events in the datastore.