4. A system that is arranged for generating extraction rules over a network, comprising: a server device, including: a transceiver that is operative to communicate over the network; a memory that is operative to store at least instructions; and a processor device that is operative to execute instructions that enable actions, including: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; transmitting for display a user interface including a first event and a plurality of second events of the set of events; receiving data indicating a selection of a portion of text within the first event; automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event.
4. A system that is arranged for generating extraction rules over a network, comprising: a server device, including: a transceiver that is operative to communicate over the network; a memory that is operative to store at least instructions; and a processor device that is operative to execute instructions that enable actions, including: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; transmitting for display a user interface including a first event and a plurality of second events of the set of events; receiving data indicating a selection of a portion of text within the first event; automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event. 29. The system of claim 4 , wherein the first event includes machine data.