1. A computer-implemented method comprising: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and: selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field; or selecting sub-portions of text to extract from within the selected field.