1. A system, comprising: a set of one or more processors; and a memory coupled to the set of one or more processors, wherein instructions provided by the memory to the set of one or more processors, when executed, cause the set of one or more processors to: receive raw data from a first remote device; determine that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules; perform a clustering function on the raw data; generate at least one parser rule based at least in part on the clustering; store, in a data store, the generated at least one parser rule; receive additional raw data from a second remote device, wherein the additional raw data received from the second remote device has an undefined source type; and recommend to an administrator of the second remote device that the source type of the additional raw data be set to a name specified by an administrator of the first remote device.