1. A computer-implemented method, comprising: receiving a query including a criterion for searching a set of events stored across a plurality of distributed machines, wherein each distributed machine has access to search a subgroup of the stored set of events, wherein each distributed machine has access to search a subgroup different than subgroups that other distributed machines have access to search, and wherein each event is associated with a timestamp; in response to receiving the query, directing the plurality of distributed machines to search, in respective subgroups to which they have access, for events responsive to the query; receiving from the distributed machines information about values for a field that are extracted from the events responsive to the query; synthesizing the information about the values for the field to determine a number corresponding to how many unique values exist for the field in the events responsive to the query; displaying a field name representing the field and the number corresponding to how many unique values exist for the field in a field picker, wherein the field picker lists a plurality of field names corresponding to fields defined for the events responsive to the query; displaying information about a subset of the events that are both responsive to the query and that meet a criterion for a field corresponding to a field name selected from the list of the plurality of field names.