21. A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to: receive raw data on a computing device; divide the raw data into a set of time stamped searchable events; store the set of events in an indexed data store; apply an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value; extract a value from a field within an event, wherein the value is extracted using the extraction rule; and display the event in a graphical interface, wherein the value extracted from the field within the event is emphasized.
21. A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to: receive raw data on a computing device; divide the raw data into a set of time stamped searchable events; store the set of events in an indexed data store; apply an extraction rule to the set of events, wherein an extraction rule defines a field within an event from which to extract a value; extract a value from a field within an event, wherein the value is extracted using the extraction rule; and display the event in a graphical interface, wherein the value extracted from the field within the event is emphasized. 25. The computer-program product of claim 21 , further including instructions configured to cause the data processing apparatus to: receive input corresponding to a selection of the emphasized value from the displayed event; and display one or more extraction rules that extract the selected emphasized value from the event when applied to the event.