1. A computer-implemented method comprising: segmenting unstructured raw machine data into a plurality of events; associating a timestamp with each event of the plurality of events; storing the plurality of events as unstructured data in an unstructured data store with associated timestamps, wherein the unstructured data in the unstructured data store includes the unstructured raw machine data that has been segmented and timestamped; receiving, at a query converter, a structured query in a structured query language from an application; generating, by the query converter, a second query in a second query language associated with the unstructured data store, based on the structured query; causing execution of the second query against the unstructured data stored in the unstructured data store; receiving a result of execution of the second query against the unstructured data stored in the unstructured data store; and causing an indication of the result to be provided to the application for output to a user, wherein the indication of the result is provided to the application as a direct response to the structured query, without requiring any additional query from the application.
1. A computer-implemented method comprising: segmenting unstructured raw machine data into a plurality of events; associating a timestamp with each event of the plurality of events; storing the plurality of events as unstructured data in an unstructured data store with associated timestamps, wherein the unstructured data in the unstructured data store includes the unstructured raw machine data that has been segmented and timestamped; receiving, at a query converter, a structured query in a structured query language from an application; generating, by the query converter, a second query in a second query language associated with the unstructured data store, based on the structured query; causing execution of the second query against the unstructured data stored in the unstructured data store; receiving a result of execution of the second query against the unstructured data stored in the unstructured data store; and causing an indication of the result to be provided to the application for output to a user, wherein the indication of the result is provided to the application as a direct response to the structured query, without requiring any additional query from the application. 8. The computer-implemented method of claim 1 , further comprising: identifying a value of a field in an event stored in the unstructured data store, based on an extraction rule that specifies where to find a subportion of text within an event.