1. An apparatus comprising: a memory for storing instructions; and a processor that executes instructions to enable actions, including; receiving first machine data from a first source; receiving second machine data from a second source, wherein there is no explicit common structure shared among the first machine data and the second machine data; generating, for each of the first machine data and the second machine data, a source signature that includes a result of a hash function, wherein the result of the hash function is built of a plurality of elements within the data; determining, for each of the first machine data and the second machine data, a domain for the data using the result of the hash function; determining, for each of the first machine data and the second machine data, a rule for identifying separate events within the machine data, wherein the rule for the first machine data is different from the rule for the second machine data, and wherein the rule is determined based on the determined domain; and automatically organizing, for each of the first machine data and the second machine data, the received machine data into a plurality of events using the determined rule.