1. A computer-implemented method, comprising: receiving raw data on a computing device; dividing the raw data into a set of time stamped searchable events; storing the set of events in an indexed data store; applying an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value; extracting a value from a field within an event, wherein the value is extracted using the extraction rule; and displaying the event in a graphical interface, wherein the value extracted from the field within the event is emphasized.
9. The method of claim 1 , further comprising: extracting an additional value in an additional filed defined by an additional extraction rule; and determining that the field and the additional field overlap.