9. A method, comprising: receiving, via a set of one or more interfaces, raw data from a first remote device; determining, using a set of one or more processors, that the raw data does not, within a predefined confidence measure, conform to any rules included in a set of rules; performing, using the set of one or more processors, a clustering function on the raw data; generating, using the set of one or more processors, at least one parser rule based at least in part on the clustering; storing, using the set of one or more processors, the generated at least one parser rule in a data store; receiving, via the set of one or more interfaces, additional raw data from a second remote device, wherein the additional raw data received from the second remote device has an undefined source type; and recommending, using the set of one or more processors, to an administrator of the second remote device that the source type of the additional raw data be set to a name specified by an administrator of the first remote device.
14. The method of claim 9 further comprising evaluating, using the set of one or more processors, the raw data received from the second remote device against the generated parser rule.