1. A method, comprising: receiving machine generated event log data which includes one or more events occurring over a window of time, wherein each event includes a first node, a second node, and a timestamp; aggregating the events into a plurality of aggregated graph snapshots; identifying one or more communities within the plurality of aggregated graph snapshots; determining one or more community tracking links between communities in the plurality of aggregated graph snapshots; using a processor to identify, based at least in part on the community tracking links, a community that has an anomalous evolution in the plurality of aggregated graph snapshots compared to the evolution of other communities; and displaying the communities, wherein the display includes the community tracking links and identifies the community that has the anomalous evolution.