Presenting field values based on a selected delimiter type

1 . A computer-implemented method comprising:

causing display, via a graphical user interface, of an indication of a delimiter mode that is used to identify values within fields that are separated from one another by delimiters;

causing display, via the graphical user interface and based on the delimiter mode, of a plurality of delimiter types to use for identifying the values within the fields separated by the delimiters;

causing display, via the graphical user interface, of:

a first field and a corresponding first set of one or more values from a plurality of events, wherein the first field is identified based on a delimiter type selected from the plurality of delimiter types and the first set of one or more values is extracted, via a processor, from the plurality of events based on the delimiter type selected, and

a second field and a corresponding second set of one or more values from the plurality of events, wherein the second field is identified based on the delimiter type selected from the plurality of delimiter types and the second set of one or more values is extracted, via the processor, from the plurality of events based on the delimiter type selected.

2 . The computer-implemented method of claim 1 , wherein the delimiter type selected from the plurality of delimiter types comprises one of a carriage return, a tab, a space, a comma, a semi-colon, a colon, an ampersand, an apostrophe, an asterisk, a back slash, a brace, a bracket, a carat, a parenthesis, a percent, a pound, an underscore, or a forward slash.

3 . The computer-implemented method of claim 1 , wherein the first set of the one or more values are extracted from the plurality of events by:

identifying a first delimiter of the delimiter type selected from the plurality of delimiter types in each event of the plurality of events; and

identifying the first set of the one or more values from the plurality of events that correspond with the identified first delimiter.

4 . The computer-implemented method of claim 1 further comprising:

receiving an indication of a data source;

receiving a selection of a sample event from the plurality of events associated with the data source;

causing display, via the graphical user interface, of the

sample event in association with an option to select the delimiter mode and an option to select a regular expression mode; and

receiving a user selection of the delimiter mode.

5 . The computer-implemented method of claim 1 further comprising receiving a first field name for the first field and a second field name for the second field.

6 . The computer-implemented method of claim 1 further comprising:

causing display, via the graphical user interface, of an option to select the delimiter mode and an option to select a regular expression mode; and

providing a recommendation indicating a preferred mode to use based on the plurality of events.

7 . The computer-implemented method of claim 1 further comprising causing the graphical user interface to present a sample event of the plurality of events while receiving a first input identifying the delimiter mode.

8 . The computer-implemented method of claim 1 further comprising:

providing an option to select the delimiter mode and an option to select a regular expression mode; and

providing a recommendation indicating a preferred mode to use based on the plurality of events, wherein the delimiter mode is provided as the recommendation when the plurality of events include a consistent number of delimiters and a same type of delimiters and the regular expression mode is provided as the recommendation when the plurality of events do not include the consistent number of delimiters or the same type of delimiters.

9 . The computer-implemented method of claim 1 further comprising providing a recommendation of the delimiter type to use for identifying the values within the fields, wherein the recommended delimiter type to use is selected based on a scan of the plurality of events.

10 . The computer-implemented method of claim 1 further comprising:

receiving a regular expression rule to use for identifying the values within the fields; and

identifying the first set of the one or more values from the plurality of events based on the delimiter type selected and the regular expression rule.

11 . The computer-implemented method of claim 1 , wherein the first set of the one or more values are presented with a value count that indicates a number of instances the value appears in the plurality of events.

12 . The computer-implemented method of claim 1 , wherein each value of the first set of the one or more values is presented in a row of the corresponding event.

13 . The computer-implemented method of claim 1 further comprising:

after assigning the identified first set of the one or more values to the first field and the second set of the one or more values to the second field, receiving a user selection to use a regular expression rule to identify substring values within the first set of the one or more values of the first field;

receiving an indication of a sample substring value within one of the one or more values within the first set of the one or more values;

based on the indicated sample substring value, generating the regular expression rule to use to identify the substring values within the first set of the one or more values of the first field; and

using the regular expression rule to identify the substring values within the first set of the one or more values of the first field.

14 . The computer-implemented method of claim 1 further comprising:

after assigning the identified first set of the one or more values to the first field and the second set of the one or more values to the second field, receiving a user selection to use a new delimiter type to identify substring values within the first set of the one or more values of the first field;

receiving an indication of the new delimiter type; and

using the new delimiter type to identify the substring values within the first set of the one or more values of the first field.

15 . The computer-implemented method of claim 1 , wherein the plurality of events comprise raw machine data.

16 . One or more computer-storage media storing computer-useable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

causing display, via a graphical user interface, of an indication of a delimiter mode that is used to identify values within fields that are separated from one another by delimiters;

causing display, via the graphical user interface and based on the delimiter mode, of a plurality of delimiter types to use for identifying the values within the fields separated by the delimiters;

causing display, via the graphical user interface, of:

a first field and a corresponding first set of one or more values from a plurality of events, wherein the first field is identified based on a delimiter type selected from the plurality of delimiter types and the first set of one or more values is extracted, via a processor, from the plurality of events based on the delimiter type selected, and

a second field and a corresponding second set of one or more values from the plurality of events, wherein the second field is identified based on the delimiter type selected from the plurality of delimiter types and the second set of one or more values is extracted, via the processor, from the plurality of events based on the delimiter type selected.

17 . The one or more computer-storage media of claim 16 , wherein the first set of the one or more values are extracted from the plurality of events by:

identifying a first delimiter of the delimiter type selected from the plurality of delimiter types in each event of the plurality of events; and

identifying the first set of the one or more values from the plurality of events that correspond with the identified first delimiter.

18 . The one or more computer-storage media of claim 16 , wherein the delimiter type selected from the plurality of delimiter types comprises one of a carriage return, a tab, a space, a comma, a semi-colon, a colon, an ampersand, an apostrophe, an asterisk, a back slash, a brace, a bracket, a carat, a parenthesis, a percent, a pound, an underscore, or a forward slash.

19 . A system comprising:

one or more data processors; and

one or more computer-storage media storing computer-useable instructions that, when executed by the one or more data processors, cause the one or more data processors to perform operations comprising:

causing display, via a graphical user interface, of an indication of a delimiter mode that is used to identify values within fields that are separated from one another by delimiters;

causing display, via the graphical user interface and based on the delimiter mode, of a plurality of delimiter types to use for identifying the values within the fields separated by the delimiters;

causing display, via the graphical user interface, of:

a first field and a corresponding first set of one or more values from a plurality of events, wherein the first field is identified based on a delimiter type selected from the plurality of delimiter types and the first set of one or more values is extracted, via a processor, from the plurality of events based on the delimiter type selected, and

a second field and a corresponding second set of one or more values from the plurality of events, wherein the second field is identified based on the delimiter type selected from the plurality of delimiter types and the second set of one or more values is extracted, via the processor, from the plurality of events based on the delimiter type selected.

20 . The system of claim 19 , wherein the first set of one or more values are presented with a value count that indicates a number of instances the first set of one or more values appear in the plurality of events.