1. A method, comprising: receiving, at a first segment and a second segment in a massively parallel processing (MPP) database system, machine generated event log data which includes one or more events occurring during a first window of time and one or more one or more events occurring during a first window of time, wherein each event includes a first node, a second node, and a timestamp; aggregating the events into a plurality of aggregated graph snapshots, including by: sending, from the first segment to the second segment, any machine generated event log data associated with events occurring during the second window of time; sending, from the second segment to the first segment, any machine generated event log data associated with events occurring during the first window of time; using a first hardware processor on the first segment to generate a first aggregated graph snapshot associated with the first window of time; and using a second hardware processor on the second segment to generate a second aggregated graph snapshot associated with the second window of time; identifying one or more communities within the plurality of aggregated graph snapshots, including by: identifying, on the first segment, one or more communities within the first aggregated graph snapshot; storing, on the first segment, the communities identified in the first aggregated graph snapshot; identifying, on the second segment, one or more communities within the second aggregated graph snapshot; and storing, on the second segment, the communities identified in the second aggregated graph snapshot; determining one or more community tracking links between communities in the plurality of aggregated graph snapshots, including by: sending, from the first segment to the second segment, the communities identified in the first aggregated graph snapshot; comparing, on the second segment, the communities identified in the first aggregated graph snapshot and the communities identified in the second aggregated graph snapshot in order to generate one or more community tracking links between the communities identified in the first aggregated graph snapshot and the communities identified in the second aggregated graph snapshot; and storing, on the second segment, the community tracking links between the communities identified in the first aggregated graph snapshot and the communities identified in the second aggregated graph snapshot; using a processor to identify, based at least in part on the community tracking links, a community that has an anomalous evolution in the plurality of aggregated graph snapshots compared to the evolution of other communities; and displaying the communities, wherein the display includes the community tracking links and identifies the community that has the anomalous evolution.