Techniques for querying time-series based event data

1 . A computer-implemented method for managing timeseries data, comprising:

executing, by a processor, a query for event data in a discoverable event stream, wherein the discoverable event stream stores event data including multiple instances of events received from multiple objects in a single stream ordered by time, such that a property corresponding to one of the multiple objects has multiple different values at multiple different time instances;

determining, based on a timeseries function, a subset of the multiple different values for the property in the multiple instances of events that correspond to the multiple different time instances to return for the query;

returning the subset of the multiple different values for the property for the query;

creating, by the processor based on the multiple instances of events identified from the discoverable event stream, a new event indicating that at least one of the multiple different values for the property has changed from a previous value by at least a threshold; and

adding, by the processor, the new event to the discoverable event stream including applying a timestamp to the new event in the discoverable event stream.

2 . The computer-implemented method of claim 1 , wherein the timeseries function includes an implicit last function, and wherein the subset of the multiple different values for the query includes a last value from a last occurring instance of the multiple instances of events that includes a value for the property.

3 . The computer-implemented method of claim 1 , wherein the timeseries function includes a time-driven window function associated with a time period for which to capture the multiple instances of events, and wherein the subset of the multiple different values for the property includes the subset of the multiple different values during the time period.

4 . The computer-implemented method of claim 3 , wherein the time-driven window function includes a progressive time window function, and wherein the time period corresponds to a progressive time window starting at a time before an end of a previous time window.

5 . The computer-implemented method of claim 1 , wherein the timeseries function includes an event-driven window function associated with an event based on which to capture the multiple instances of events, and wherein the subset of the multiple different values for the property includes the subset of the multiple different values based on the event.

6 . The computer-implemented method of claim 5 , wherein the event-driven window function includes a trailing window function, and wherein the subset of the multiple different values for the property includes a specified number of previous values for the property after the event.

7 . The computer-implemented method of claim 1 , further comprising:

determining, from the query, subqueries that result in multiple intermediate states of collecting the instances of multiple instances of events;

separately executing each of the subqueries and storing results of the corresponding intermediate state of the multiple intermediate states; and

combining the results as part of executing the query to identify the multiple instances of event data.

8 . The computer-implemented method of claim 1 , wherein executing the query includes executing multiple queries over one or more time windows of the multiple instances of events, each of the multiple queries identifying a separate collection of the multiple instances of the events related to the object, and further comprising:

determining, from the multiple queries, that at least two queries correspond to a common property;

determining a common subquery for the multiple queries; and

executing the common subquery over a common time window of the multiple instances of events,

wherein executing each of the at least two queries is based on the common subquery.

9 . The computer-implemented method of claim 1 , wherein the query indicates a comparison for a value of the property, and wherein adding the new event is based at least in part on an outcome of the comparison for the value of the property for at least a portion of the multiple instances of events.

10 . The computer-implemented method of claim 9 , wherein the new event includes an action event to cause performing of an external action.

11 . The computer-implemented method of claim 9 , wherein the new event includes an indication of the outcome of the comparison for the value of the property.

12 . The computer-implemented method of claim 1 , further comprising obtaining, from a model store, an indication of the query to be executed over a time window of the multiple instances of events.

13 . The computer-implemented method of claim 1 , further comprising providing a user interface to facilitate defining the query.

14 . An apparatus, comprising:

a memory; and

a processor coupled with the memory and configured to:

execute a query for event data in a discoverable event stream, wherein the discoverable event stream stores event data including multiple instances of events received from multiple objects in a single stream ordered by time, such that a property corresponding to one of the multiple objects has multiple different values at multiple different time instances;

determine, based on a timeseries function, a subset of the multiple different values for the property in the multiple instances of events that correspond to the multiple different time instances to return for the query;

return the subset of the multiple different values for the property for the query;

create, based on the multiple instances of events identified from the discoverable event stream, a new event indicating that at least one of the multiple different values for the property has changed from a previous value by at least a threshold; and

add the new event to the discoverable event stream including applying a timestamp to the new event in the discoverable event stream.

15 . The apparatus of claim 14 , wherein the timeseries function includes an implicit last function, and wherein the subset of the multiple different values for the query includes a last value from a last occurring instance of the multiple instances of events that includes a value for the property.

16 . The apparatus of claim 14 , wherein the timeseries function includes a time-driven window function associated with a time period for which to capture the multiple instances of events, and wherein the subset of the multiple different values for the property includes the subset of the multiple different values during the time period.

17 . The apparatus of claim 14 , wherein the timeseries function include an event-driven window function associated with an event based on which to capture the multiple instances of events, and wherein the subset of the multiple different values for the property includes the subset of the multiple different values based on the event.

18 . A non-transitory computer-readable device storing instructions thereon that, when executed by a computing device, cause the computing device to perform operations for managing timeseries data, comprising:

executing, by a processor, a query for event data in a discoverable event stream, wherein the discoverable event stream stores event data including multiple instances of events received from multiple objects in a single stream ordered by time, such that a property corresponding to one of the multiple objects has multiple different values at multiple different time instances;

determining, based on a timeseries function, a subset of the multiple different values for the property in the multiple instances of events that correspond to the multiple different time instances to return for the query;

returning the subset of the multiple different values for the property for the query;

creating, by the processor based on the multiple instances of events identified from the discoverable event stream, a new event indicating that at least one of the multiple different values for the property has changed from a previous value by at least a threshold; and

adding, by the processor, the new event to the discoverable event stream including applying a timestamp to the new event in the discoverable event stream.

19 . The non-transitory computer-readable device of claim 18 , wherein the timeseries function includes an implicit last function, and wherein the subset of the multiple different values for the query includes a last value from a last occurring instance of the multiple instances of events that includes a value for the property.