1. A method, comprising: organizing machine data stored in at least one storage device into a plurality of events by determining event boundaries in the machine data, each event in the plurality of events including some machine data from the stored machine data; identifying, in the plurality of events, one or more events that include a particular portion of machine data; wherein the method is performed by one or more computing devices.