11. A computer-implemented system comprising: a processor, memory coupled to the processor, and instructions stored in the memory that implement the actions of: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and: selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field; or selecting sub-portions of text to extract from within the selected field.
18. The computer-implemented system of claim 11 , further including: causing display of a second user interface providing tools that implement user selection among the fields; receiving further data indicating a selection of a selected field; and causing display of a frequency table of values of the selected field extracted from a sample of the events, wherein the frequency table includes a list of values extracted and for each value in the list a frequency and an active filter control, wherein the active filter control filters events to be displayed based on a selected value.