1. A computer-implemented method for organizing machine data into events comprising: collecting machine data by a computer; classifying, by the computer, the collected machine data into domains based on source signatures for the domains, the source signatures previously created from samples of machine data from known domains and based on functions of punctuation in the samples of machine data; automatically learning, by the computer, break rules for each domain based on the collected machine data from that domain, at least one of the rules indicating when multiple lines of machine data represent a single event; and on a domain by domain basis, aggregating, by the computer, the collected machine data into events based on the learned break rules.