11. A computer-implemented system comprising: a processor, memory coupled to the processor, and instructions stored in the memory that implement the actions of: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and: selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field; or selecting sub-portions of text to extract from within the selected field.
11. A computer-implemented system comprising: a processor, memory coupled to the processor, and instructions stored in the memory that implement the actions of: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; receiving data indicating selection of a first event from among a first plurality of events and data indicating a selection of one or more portions of text within the raw data of the first event to be extracted as one or more fields; automatically determining an initial extraction rule that extracts the selected portions of text within the first event; causing display of a first interface providing tools that implement user modification of the extraction rule, including selecting a field from the one or more fields and: selecting one or more non-adjoining strings to concatenate with the selected field; selecting a portion of the selected field to be trimmed from the beginning or end of the selected field; or selecting sub-portions of text to extract from within the selected field. 15. The computer-implemented system of claim 11 , further including: causing display of a second user interface providing tools that implement user selection of a sampling strategy to determine the events in a display; receiving further data indicating a selection of the sampling strategy; sampling the events to be displayed; and causing display of a third user interface including an annotated version of the plurality of events, wherein the annotated version indicates the portions of text within the plurality of events extracted by the initial extraction rule.