4. A computer-implemented method for generating a normalized event that adheres to a normalized schema, comprising: receiving an unstructured event; dividing, by at least one hardware processor, the unstructured event into a plurality of tokens; for each token, determining a value for each feature within a set of features, wherein the set of features includes a Value feature and a Type feature, and wherein a value of a token's Type feature is determined based on a value of the token's Value feature; and for each token: for each field of the normalized schema, determining by the at least one hardware processor a probability that the token maps to the field; responsive to the token's Type feature having a value other than Unknown or Word: determining the field of the normalized schema with the highest probability; mapping the token to the determined field; determining a value of the determined field based on the value of the token's Value feature; and setting the determined field of a normalized event to the determined value; and responsive to the token's Type feature having a value of Word and responsive to the highest probability exceeding a threshold: determining the field of the normalized schema with the highest probability; mapping the token to the determined field; determining a value of the determined field based on the value of the token's Value feature; and setting the determined field of the normalized event to the determined value.
4. A computer-implemented method for generating a normalized event that adheres to a normalized schema, comprising: receiving an unstructured event; dividing, by at least one hardware processor, the unstructured event into a plurality of tokens; for each token, determining a value for each feature within a set of features, wherein the set of features includes a Value feature and a Type feature, and wherein a value of a token's Type feature is determined based on a value of the token's Value feature; and for each token: for each field of the normalized schema, determining by the at least one hardware processor a probability that the token maps to the field; responsive to the token's Type feature having a value other than Unknown or Word: determining the field of the normalized schema with the highest probability; mapping the token to the determined field; determining a value of the determined field based on the value of the token's Value feature; and setting the determined field of a normalized event to the determined value; and responsive to the token's Type feature having a value of Word and responsive to the highest probability exceeding a threshold: determining the field of the normalized schema with the highest probability; mapping the token to the determined field; determining a value of the determined field based on the value of the token's Value feature; and setting the determined field of the normalized event to the determined value. 6. The method of claim 4 , wherein the set of features further includes an Index feature or a Previous Word feature.