Performance data characterizing operations of an application may be collected by time interval, and a plurality of keys may be associated with each element of the performance data. A first time interval may be received. An iterative group-and-filter search may be executed against the keyed elements within the first time interval, each iteration including an iteration key used to perform a key-based grouping operation followed by a group-based filter operation, wherein each iteration key is added to a composite key at each iteration. A selection of at least one keyed element within the first time interval and obtained from the iterative group-and-filter search may be received. A second time interval that precedes the first time interval may be received, and the keyed elements may be filtered using the composite key and within the second time interval to return the at least one keyed element within the second time interval.