1. A computer-implemented method comprising: gathering, using a computing device, a stream of data; transforming the stream of data into a plurality of events, wherein each event includes a portion of the stream of data; associating a time stamp with each event of the plurality of events; storing the plurality of events and their associated time stamps; displaying a first event of the plurality of events; receiving a selection of a portion of text within the first event; determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; displaying a second event of the plurality of events; and indicating, for the second event, a value of the field for the second event that would be extracted by applying the extraction rule to the second event.