1. A method for searching data using a network device that is operative to perform actions, comprising: accessing an event, the event including machine data; determining, for a field name, a field value included within the machine data in the event; determining a posting value for the event that identifies a location in a datastore at which data for the event is stored; identifying a lexicon record in a lexicon representing the field value for the field name, and adding the posting value for the event to the lexicon record.