1. A computer implemented method, comprising: accessing time stamped events in a data store on a computing device including one or more processors, wherein the set of events are searchable; maintaining a data model that is associated with a set of the time stamped events, wherein the data model defines a schema to apply to the set of the time stamped events, wherein the data model includes one or more sub-models, and wherein each sub-model of the one or more sub-models is associated with a subset of events in the set of the time stamped events, the subset of events being smaller than the set of the time stamped events; causing display of a graphical interface that lists the one or more sub-models of the data model; receiving first input corresponding to a selection of a particular sub-model of the one or more sub-models through the graphical interface; responsive to the first input, narrowing the set of the time stamped events that are searchable to a particular subset of events that is associated with the selected particular sub-model; subsequent to receiving the first input, receiving second input corresponding to criteria for a search query; after receiving the second input, initiating a search that uses the received criteria to evaluate values extracted using an extraction rule or a regular expression from events in the particular subset of events, wherein the extraction rule or the regular expression corresponds to a field in the schema.
3. The method of claim 1 , wherein each sub-model further includes one or more field definitions, wherein each field definition defines a field to apply to the subset of events associated with the sub-model in order to derive, from data for each event in the associated subset, at most one value for a field corresponding to the field definition, the method further comprising: in response to receiving the first input corresponding to the selection of the particular sub-model, enabling search queries on the particular subset of events that is associated with the selected particular sub-model using particular fields defined by one or more particular field definitions associated with the selected particular sub-model; wherein the criteria corresponding to the second input includes at least first criteria for at least a first field defined by the one or more particular field definitions associated with the selected particular sub-model, wherein the first criteria is received through a graphical interface; generating the search query in a search language designed for accessing the time stamped events in the data store, wherein the search query includes the first criteria for the first field, and wherein the search query executes only over the particular subset of events that correspond to the selected particular sub-model; and executing the search query.