receiving, by a distributed search engine, a request including a sequence of queries, the sequence of queries including a first query and a second query, the second query succeeding the first query in the sequence of queries;

executing, by the distributed search engine, the first query over a first dataset to determine a first event;

executing, by the distributed search engine, the second query over a second dataset to determine a second event, the second event occurring after the first event, wherein the first and second datasets reside in multiple data sources;

generating, by the distributed search engine and in response to the request, a further sequence of queries including the first event and the second event;

in response to determining that the second event precedes an event A1 and event A2, wherein the event A1 and the event A2 are results of executing the first query and the event A1 occurring prior to the event A2, preventing, by the distributed search engine, the event A1 from generating the further sequence.