13. An apparatus, comprising: a subsystem, on a first device, implemented at least partially in hardware, that organizes machine data into a plurality of events, each event in the plurality of events being associated with a timestamp and including a portion of machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment; a subsystem, implemented at least partially in hardware, that receives, via a user interface, a user selection of a text value from displayed machine data associated with an event among the plurality of events, and automatically generates at least one extraction rule in response to the selection of the text value from machine data associated with the event; and a subsystem, implemented at least partially in hardware, that extracts at least one text value from at least one event in the plurality of events using the at least one extraction rule.
13. An apparatus, comprising: a subsystem, on a first device, implemented at least partially in hardware, that organizes machine data into a plurality of events, each event in the plurality of events being associated with a timestamp and including a portion of machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment; a subsystem, implemented at least partially in hardware, that receives, via a user interface, a user selection of a text value from displayed machine data associated with an event among the plurality of events, and automatically generates at least one extraction rule in response to the selection of the text value from machine data associated with the event; and a subsystem, implemented at least partially in hardware, that extracts at least one text value from at least one event in the plurality of events using the at least one extraction rule. 15. The apparatus as recited in claim 13 , wherein two or more extraction rules may define fields in an event that partially or completely overlap each other.