5. The method of claim 4 , wherein the second set of one or more fields comprises a subset of the set of one or more fields identified by the root object schema.
4. A method, comprising: receiving a selection of an object included in a data model that has both a root object and at least one child object; the root object includes: a root object query that, when executed, returns a set of time stamped events from a data store on a computing device, each event including a portion of raw machine data; and a root object schema identifying a set of one or more fields, each field defined by an extraction rule or regular expression that can be used to extract a value for the field from each event in a subset of the set of time stamped events, each extraction operating on the raw machine data in an event without modifying the event's raw machine data; the at least one child object includes: a child object query that provides for narrower search criteria than the root object query such that, when the child object query is executed against the time stamped events in the data store, the child object query returns a second set of time stamped events that is a subset of the set of time stamped events generated by executing the root object query against the time stamped events in the data store; and a child object schema identifying a second set of one or more fields, each field defined by an extraction rule or regular expression that can be used to extract a value for the field from each event in a subset of the second set of time stamped events, each extraction operating on the raw machine data in an event without modifying the event's raw machine data; receiving from a user a search query that uses only fields that are included in the object schema of the selected object; and executing the search query received from the user only against the set of time stamped events generated by executing the object query of the selected object against the set of time stamped events in the data store.