1. A method, comprising: organizing, on a first device, machine data into a plurality of events, each event in the plurality of events being associated with a timestamp and including a portion of machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment; receiving, via a user interface, a user selection of a text value from displayed machine data associated with an event among the plurality of events; automatically generating at least one extraction rule in response to the selection of the text value from machine data associated with the event; and extracting at least one text value from at least one event in the plurality of events using the at least one extraction rule.