1. A method, comprising: analyzing machine data stored in at least one storage device; based on the machine data analysis, automatically creating rules, for different machine data sources, for identification of boundaries of events within the machine data; organizing machine data into a plurality of events using at least one rule among the automatically created rules; wherein the method is performed by one or more computing devices.