Previewing an extraction rule for a field in exemplary events and modifying the rule through counter-example

Abstract

Embodiments are directed towards real time display of event records and extracted values based on at least one extraction rule, such as a regular expression. A user interface may be employed to enable a user to have an extraction rule automatically generate and/or to manually enter an extraction rule. The user may be enabled to manually edit a previously provided extraction rule, which may result in real time display of updated extracted values. The extraction rule may be utilized to extract values from each of a plurality of records, including event records of unstructured machine data. Statistics may be determined for each unique extracted value, and may be displayed to the user in real time. The user interface may also enable the user to select at least one unique extracted value to display those event records that include an extracted value that matches the selected value.

1 - 30 . (canceled) 
     
     
         31 . A computer-implemented method, comprising:
 receiving machine data;   generating, using one or more processors, a set of events, wherein each event in the set of events includes a portion of the machine data;   associating a time with each event in the set of events, the time for each event extracted from the machine data included in that event;   storing the set of events in a data store such that they are searchable at least by their associated times;   displaying an extraction rule, wherein the extraction rule specifies how to extract a value for a field from machine data included in an event;   displaying a subset of events of the set of events;   emphasizing in the displayed subset of events a value for the field that would be extracted from each of the events in the subset of events by applying the extraction rule;   receiving input indicating that the emphasized value in a given event in the subset of events should not be the value for the field for the given event;   based on the input, automatically modifying the extraction rule so that it would extract a different value as a value for the field for the given event when applied to the given event; and   modifying the displayed given event to emphasize the different value for the field for the given event.   
     
     
         32 . The method of  claim 31 , wherein the extraction rule includes a regular expression. 
     
     
         33 . The method of  claim 31 , wherein the machine data includes log data. 
     
     
         34 . The method of  claim 31 , further comprising displaying the modified extraction rule. 
     
     
         35 . The method of  claim 31 , wherein the extraction rule is received from a user through manual keyboard input. 
     
     
         36 . The method of  claim 31 , wherein the extraction rule is automatically generated to extract as the value for the field for a displayed event text that a user has selected in the event. 
     
     
         37 . The method of  claim 31 , further comprising modifying a second event in the displayed subset of events to emphasize a value that would be extracted for the field for the second event by applying the modified extraction rule to the second event. 
     
     
         38 . The method of  claim 31 , further comprising:
 receiving a label for the field corresponding to the extraction rule; and   using the label to search for an event using the field.   
     
     
         39 . The method of  claim 31 , further comprising:
 identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and   displaying one or more unique field values in the set of unique field values.   
     
     
         40 . The method of  claim 31 , further comprising:
 identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and   displaying a statistic for one or more unique field values in the set of unique field values.   
     
     
         41 . The method of  claim 31 , further comprising:
 identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events; and   displaying a statistic for one or more unique field values in the set of unique field values, wherein the statistic includes a count of events in which the unique field value appears as the value for the field or a percentage of events in which the unique field value appears as the value for the field.   
     
     
         42 . The method of  claim 31 , further comprising:
 identifying a set of unique field values that would be extracted for the field by applying the extraction rule to events in the set of events;   receiving a selection of a unique field value in the set of unique field values; and   displaying only events in the subset of events for which the extraction rule would extract the selected unique field value when applied to the events.   
     
     
         43 . A non-transitory computer-readable medium having computer-executable instructions for performing the method of  claim 31 . 
     
     
         44 . A system having one or more processors that is adapted to perform the method of  claim 31 .