1. A method, comprising: aggregating a collection of machine data stored on at least one storage device into a set of events, wherein the machine data associated with at least a subset of the events includes time information; extracting a timestamp for each event in the subset of events that includes time information; for each event that does not contain time information in the associated machine data, determining a time stamp from at least one other event in the collection of machine data; and associating the determined time stamp with the corresponding event, wherein the method is performed by one or more computing devices.