1. A computer-implemented method comprising: receiving a search query on events, each event comprising a time stamp and a portion of machine data that reflects activity in an information technology environment of at least one computing system; causing display of a set of the events that are responsive to the search query, the set of the events comprising fields, each field of the fields being defined by an extraction rule that is applied to the portion of machine data; and based on receiving a user selection of a graphical interface control associated with a particular event of the set of the events, causing display of an event limited field picker including a list of field identifiers of the fields corresponding to the particular event with corresponding field values, wherein at least one field identifier in the list of field identifiers is user selectable to toggle between causing field values of a corresponding field to be displayed for events of the set of events and causing the field values of the corresponding field to be removed from display for the events.