1. A computer-implemented method comprising: causing display of a set of events that are search results of a search query that specifies a plurality of commands, each event corresponding to a portion of raw machine data associated with a timestamp extracted from the portion of raw machine data, the display of the set of events being in a table format that includes: one or more columns, each column comprising data items of an event attribute, the data items being of the set of events; and a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column, the textual representation being selectable by a user, the textual representation including at least some of the portion of raw machine data of a corresponding event; based on a user selection of a text portion of the textual representation in a corresponding cell: causing display of a list of options corresponding to the selected text portion of the textual representation in the corresponding cell; and causing one or more commands to be added to the plurality of commands specified in the search query, wherein the one or more commands are based on an option that is selected from the list of options and the selected text portion of the textual representation in the corresponding cell.
1. A computer-implemented method comprising: causing display of a set of events that are search results of a search query that specifies a plurality of commands, each event corresponding to a portion of raw machine data associated with a timestamp extracted from the portion of raw machine data, the display of the set of events being in a table format that includes: one or more columns, each column comprising data items of an event attribute, the data items being of the set of events; and a plurality of rows forming cells with the one or more columns, each cell displaying a textual representation of at least one of the data items of the event attribute of a corresponding column, the textual representation being selectable by a user, the textual representation including at least some of the portion of raw machine data of a corresponding event; based on a user selection of a text portion of the textual representation in a corresponding cell: causing display of a list of options corresponding to the selected text portion of the textual representation in the corresponding cell; and causing one or more commands to be added to the plurality of commands specified in the search query, wherein the one or more commands are based on an option that is selected from the list of options and the selected text portion of the textual representation in the corresponding cell. 16. The computer-implemented method of claim 1 , comprising: based on the user selection of the text portion of the textual representation in the corresponding cell, causing a displayed representation of the search query in the user interface to be automatically updated to include a representation of the added one or more commands.