1. An apparatus for organizing machine data from a plurality of computing devices over a network, comprising: a memory for storing instructions; and a processor that executes instructions to enable actions, including: receiving machine data from the plurality of computing devices; automatically organizing received machine data into a plurality of events; constructing dynamic links between the plurality of events to represent one or more activities for an information space that corresponds to the plurality of computing devices; and presenting one or more activities that occur in the information space for review by a user.