1. A method, comprising: organizing, on a first device, machine data into a plurality of events; automatically generating at least one extraction rule based on a value selected from machine data in an event among the plurality of events; extracting at least one value from at least one event in the plurality of events using the at least one extraction rule.