1. A method, comprising: organizing machine data stored in at least one storage device into a plurality of events by determining event boundaries in the machine data, each event in the plurality of events including some machine data from the stored machine data; performing a text extraction on machine data in one or more events in the plurality of events to identify one or more events for which the extracted text matches particular criteria; wherein the method is performed by one or more computing devices.