A composition operation 302 can be associated with an expected temporally ordered arrival of two pieces of event data 122. For example, the composition operation 302 shown in FIG. 3 can apply when first event data 122A arrives at a first point in time and second event data 122B arrives at a later second point in time. Because the first event data 122A may arrive before the second event data 122B, a rally point 306 can be created and stored when the first event data 122A arrives. The rally point 306 can then be used if and when second event data 122B also associated with the rally point 306 arrives at a later point in time. For example, a composition operation 302 can be defined to create new composition event data 304 from a child process and its parent process, if the parent process executed a command line. In this example, a rally point 306 associated with a first process can be created and stored when first event data 122A indicates that the first process runs a command line. At a later point, new event data 122 may indicate that a second process, with an unrelated parent process different from the first process, is executing. In this situation, the compute engine 102 can determine that a stored rally point 306 associated with the composition does not exist for the unrelated parent process, and not generate new composition event data 304 via the composition operation 302. However, if further event data 122 indicates that a third process, a child process of the first process, has launched, the compute engine 102 would find the stored rally point 306 associated with the first process and generate the new composition event data 304 via the composition operation 302 using the rally point 306 and the new event data 122 about the third process.
