13. The system of claim 12 , further comprising: responsive to a determination that the token is an unknown type, the token is not mapped to any field of the normalized schema.
14. The system of claim 13 , further comprising: responsive to a determination that the token is other than a word type or an unknown type, the instructions cause the at least one hardware processor to: map the token to the field of the normalized schema having the highest probability, and set the determined field of the normalized event to the determined value.