Field analyzer for event search screen

1. A method comprising:

causing display, by a computer system, of an interactive field picker element in a graphical user interface (GUI), the interactive field picker element including a set of interactive field identifiers, wherein each interactive field identifier in the set of interactive field identifiers references a corresponding field in a set of events returned in response to a search query, each event in the set of events including a timestamped portion of raw machine data, wherein the raw machine data is produced by one or more components within an information technology (IT) environment and reflects activity in the IT environment;

receiving, by the computer system, a selection by a user of a particular interactive field identifier from the set of interactive field identifiers displayed in the interactive field picker element; and

causing display, by the computer system, in response to receiving the selection by the user, of a manipulable visualization in the GUI, wherein the manipulable visualization includes at least one of a graph, a chart, or a map generated based on values included in a field referenced by the particular interactive field identifier.

2. The method of claim 1 , further comprising:

dynamically updating, by the computer system, display of the manipulable visualization in response to receiving a subsequent selection of another interactive field identifier from the set of interactive field identifiers.

3. The method of claim 1 , further comprising:

receiving, by the computer system, a subsequent selection of another interactive field identifier from the set of interactive field identifiers; and

dynamically updating, by the computer system, display of the manipulable visualization such that the updated manipulable visualization is split according to values included in a field referenced by the other interactive field identifier.

4. The method of claim 1 , further comprising:

causing display, by the computer system, of an option to modify a juxtaposition of a split in the manipulable visualization; and

dynamically updating, by the computer system, display of the manipulable visualization by modifying the juxtaposition of the split in response to a selection by the user of the option.

5. The method of claim 1 , further comprising:

causing display, by the computer system, of a literal expression describing the manipulable visualization; and

dynamically updating, by the computer system, display of the literal expression in response to receiving a subsequent selection of another interactive field identifier from the set of interactive field identifiers.

6. The method of claim 1 , further comprising:

causing display, by the computer system, of an editable literal expression describing the manipulable visualization;

receiving, by the computer system, an input by the user indicating a request to edit the literal expression; and

dynamically updating, by the computer system, display of the manipulable visualization based on the received input.

7. The method of claim 1 , further comprising:

detecting, by the computer system, a user interaction with a particular portion of the displayed manipulable visualization; and

causing display, by the computer system, of information based on events upon which the selected particular portion of the displayed manipulable visualization is based, in response to detecting the user interaction.

8. The method of claim 1 , further comprising:

detecting, by the computer system, a user interaction with a particular portion of the displayed manipulable visualization; and

causing display, by the computer system, of raw machine data associated with an event upon which the selected particular portion of the displayed manipulable visualization is based, in response to detecting the user interaction.

9. The method of claim 1 , further comprising:

receiving, by the computer system, a selection of a time range in response to detecting a user interaction with the manipulable visualization; and

dynamically updating, by the computer system, display of the manipulable visualization based on the selected time range.

10. The method of claim 1 , wherein the set of interactive field identifiers in the displayed interactive field picker element are grouped based on field type.

11. The method of claim 1 , wherein the manipulable visualization is based on an aggregation of the values included in the in the field referenced by the particular interactive field identifier.

12. The method of claim 1 , further comprising:

causing display, by the computer system, of an option to select an aggregation function to apply to the values included in the field referenced by the particular interactive field identifier.

13. The method of claim 1 , wherein the manipulable visualization is based on a filtered set of the values included in the in the field referenced by the particular interactive field identifier.

14. The method of claim 1 , further comprising:

causing display, by the computer system, of an option to select a filter to apply to the values included in the field referenced by the particular interactive field identifier.

15. The method of claim 1 , further comprising:

dynamically updating, by the computer system, display of the manipulable visualization in response to receiving an input indicating a request to apply an aggregation function or a filter to the values included in the field referenced by the particular interactive field identifier.

16. The method of claim 1 , wherein causing display of the manipulable visualization includes:

defining a visualization parameter based on the field referenced by the particular interactive field identifier;

wherein the manipulable visualization based on the defined visualization parameter.

17. The method of claim 1 , wherein causing display of the manipulable visualization includes:

generating a subsequent search query based on the particular interactive field identifier; and

receiving, in response to execution of the subsequent search query, results based on the values included in the field referenced by the particular interactive field identifier, wherein the manipulable visualization is based on the received results.

18. The method of claim 1 , further comprising:

causing display, by the computer system, of an expression of a subsequent search query based on the particular interactive field identifier.

19. The method of claim 1 , wherein the field is defined based on an extraction rule for extracting a sub-portion of the data included in an event.

20. The method of claim 1 , wherein the field is defined based on a late-binding schema applied as the search query is executed.

21. The method of claim 1 , wherein the data relating to activity in the IT environment includes timestamped machine data.

22. The method of claim 1 , wherein the set of events are based on a predefined data model.

23. The method of claim 1 , further comprising:

prior to causing display of the interactive field picker element in the GUI:

receiving, by the computer system, via a search interface, an expression of the search query in a search language; and

receiving, by the computer system, the set of events in response to execution of the search query based on the received expression.

24. The method of claim 1 , wherein the search query is received, via a search interface, as an expression in a pipelined search language.

25. The method of claim 1 , wherein if the particular interactive field identifier references a non-time dimension field, the manipulable visualization is displayed as a bar chart.

26. The method of claim 1 , wherein if the particular interactive field identifier references a time dimension field, the manipulable visualization is displayed as a line graph.

27. A computer system comprising:

processing unit; and

a storage device having instructions stored thereon, which when executed by the processing unit cause the computer system to:

cause display of an interactive field picker element in a graphical user interface (GUI), the interactive field picker element including a set of interactive field identifiers, wherein each interactive field identifier in the set of interactive field identifiers references a corresponding field in a set of events returned in response to a search query, each event in the set of events including a timestamped portion of raw machine data, wherein the raw machine data is produced by one or more components within an information technology (IT) environment and reflects activity in the IT environment;

receive a selection by a user of a particular interactive field identifier from the set of interactive field identifiers displayed in the interactive field picker element; and

cause display, in response to receiving the selection by the user, of a manipulable visualization in the GUI, wherein the manipulable visualization includes at least one of a graph, a chart, or a map generated based on values included in a field referenced by the particular interactive field identifier.

28. A non-transitory computer-readable medium containing instructions, execution of which in a computer system causes the computer system to:

cause display of an interactive field picker element in a graphical user interface (GUI), the interactive field picker element including a set of interactive field identifiers, wherein each interactive field identifier in the set of interactive field identifiers references a corresponding field in a set of events returned in response to a search query, each event in the set of events including a timestamped portion of raw machine data, wherein the raw machine data is produced by one or more components within an information technology (IT) environment and reflects activity in the IT environment;

receive a selection by a user of a particular interactive field identifier from the set of interactive field identifiers displayed in the interactive field picker element; and

cause display, in response to receiving the selection by the user, of a manipulable visualization in the GUI, wherein the manipulable visualization includes at least one of a graph, a chart, or a map generated based on values included in a field referenced by the particular interactive field identifier.