1. A method, comprising: organizing raw machine data collected from one or more remote hardware devices, into a set of searchable, time-stamped events, wherein the collected raw machine data is produced by one or more components in an information technology environment and reflects activity in the information technology environment, wherein each event in the set of searchable, time-stamped events is searchable based on its associated time stamp; executing a computer-implemented search to identify a subset of the set of searchable, time-stamped events satisfying search criteria that includes having a time stamp occurring within a specified time period; while or after identifying the subset of the set of searchable, time-stamped events, applying a schema to the raw machine data included in each event in the subset of the set of searchable, time-stamped events in order to impose structure on the raw machine data and to extract a set of values that relate to a particular category; identifying, based on the particular category, one or more patterns among the set of values; analyzing the one or more patterns to determine whether a pattern of the one or more patterns occurs outside of a normal occurrence and indicates that a security threat exists; causing graphical display of information relating to the one or more patterns that occur outside of the normal occurrence.