3. A processor readable non-transitive storage media that includes instructions for generating extraction rules over a network, wherein execution of the instructions by a processor device enables actions, comprising: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; transmitting for display a user interface including a first event and a plurality of second events of the set of events; receiving data indicating a selection of a portion of text within the first event; automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event.
3. A processor readable non-transitive storage media that includes instructions for generating extraction rules over a network, wherein execution of the instructions by a processor device enables actions, comprising: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; transmitting for display a user interface including a first event and a plurality of second events of the set of events; receiving data indicating a selection of a portion of text within the first event; automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event. 25. The media of claim 3 , wherein the actions further comprise: receiving a selection of a portion of text within the second event; modifying the field extraction rule such that the modified field extraction rule would extract the selection of the portion of text within the first event when the modified field extraction rule is applied to the first event and would extract the selection of the portion of text within the second event when the modified field extraction rule is applied to the second event.