Distinct field name assignment in automatic field extraction
First one or more values are extracted from a plurality of events using a first extraction rule. The extracted first one or more values are assigned to a first field of the plurality of events as a first set of field-data item pairs and a field label is assigned to the first field. Second one or more values and a field label corresponding to the second one or more values are extracted from the plurality of the events using a second extraction rule, where the extracted field label corresponds to the assigned field label of the first field. The extracted second one or more values are assigned to a second field of the plurality of events as a second set of field-data item pairs, thereby distinguishing the extracted second one or more values from the extracted first one or more values.
1. A computer-implemented method, comprising:
accessing a set of events in a data store, each event in the set of events including a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment;
automatically identifying a field for the set of events based on determining the portion of raw machine data of an event includes text corresponding to a field label of the field and an associated value; and
based on the identifying of the field, automatically producing values for the field for the set of events using an extraction rule that produces the associated value for the field for the event in association with identifying the field label in text from the portion of raw machine data of the event, wherein the field is assigned a field name used to reference the field and at least some of the values in association with execution of a search query on the set of events, and the field name includes different text than the field label.
2. The method of claim 1 , wherein the field is assigned the field name based at least in part on determining the field label is an assigned field name of a different field of the set of events.
3. The method of claim 1 , wherein the field name of the field is automatically generated to include the field label and additional text.
4. The method of claim 1 , further comprising causing display of at least some of the values in a search interface responsive to the search query, wherein the field name is displayed in association with the at least some of the values.
5. The method of claim 1 , wherein the identifying the field label in text from the portion of raw machine data of the event comprises applying the extraction rule to the portion of raw machine data of the event.
6. The method of claim 1 , wherein the identifying the field label in text from the portion of raw machine data of the event comprises applying the extraction rule to a field value of a different field than the field, the field value extracted from the portion of raw machine data of the event.
7. The method of claim 1 , wherein the producing values for the field for the set of events is part of a command that automatically identifies and extracts all fields from the portion of raw machine data of the event, wherein a particular field is identified for each first text portion separated by one or more designated demarcating characters from a second text portion in the portion of raw machine data.
8. The method of claim 1 , wherein the producing values for the field for the set of events is part of a command that automatically identifies and extracts all fields from a field value of an existing field of the event, wherein a particular field is identified for each particular field label identified in the field value.
9. The method of claim 1 , wherein the producing values for the field for the set of events is part of a command that automatically identifies and extracts all fields from the portion of raw machine data of the event, wherein a particular field is identified for each particular field label identified in the field value.
10. The method of claim 1 , wherein the producing values for the field for the set of events is part of a command comprising a command modifier that specifies a set of data items of the set of events from which the command is to automatically identify and extract field label-value pairs.
11. The method of claim 1 , wherein the extraction rule comprises at least one regular expression defining identification and extraction of the associated value and the field label.
12. The method of claim 1 , wherein the field is assigned a field name that is different than the field label based on identifying the field label corresponds to an assigned field name of a different field of the set of events.
13. The method of claim 1 , further comprising causing one or more user options to be presented in a graphical under interface based on identifying that the field label corresponds to an assigned field name of a different field of the set of events, at least one of the one or more user options being user selectable to cause the field to be assigned the field name that is different than the field label.
14. The method of claim 1 , further comprising automatically determining the field name for the field by modifying the field label and assigning the modified field label as the field name.
15. The method of claim 1 , wherein the automatically identifying the field comprises analyzing the text in an event attribute of the event, and the field name for the field is automatically determined by adding text from an assigned field name of the event attribute to the field label.
16. The method of claim 1 , comprising applying a late binding schema to the set of events using the extraction rule.
17. The method of claim 1 , wherein the automatically producing values for the field is performed as part of a command of the search query being executed by a search system to produce search results of the search query.
18. A computer-implemented system comprising:
one or more processors; and
one or more computer-storage media storing computer-useable instructions that, when executed by the one or more processors, cause the one or more processors to perform a method, the method comprising:
accessing a set of events in a data store, each event in the set of events including a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment;
automatically identifying a field for the set of events based on determining the portion of raw machine data of an event includes text corresponding to a field label of the field and an associated value; and
based on the identifying of the field, automatically producing values for the field for the set of events using an extraction rule that produces the associated value for the field for the event in association with identifying the field label in text from the portion of raw machine data of the event, wherein the field is assigned a field name used to reference the field and at least some of the values in association with execution of a search query on the set of events, and the field name includes different text than the field label.
19. The system of claim 18 , wherein the field label is an assigned field name of a different field of the set of events.
20. The system of claim 18 , wherein the field name of the field includes the field label.
21. The system of claim 18 , further comprising causing display of at least some of the values in a search interface responsive to the search query, wherein the field name is displayed in association with the at least some of the values.
22. The system of claim 18 , wherein the identifying the field label in text from the portion of raw machine data of the event comprises applying the extraction rule to the portion of raw machine data of the event.
23. The system of claim 18 , wherein the identifying the field label in text from the portion of raw machine data of the event comprises applying the extraction rule to a field value of a different field than the field, the field value extracted from the portion of raw machine data of the event.
24. The system of claim 18 , wherein the producing values for the field for the set of events is part of a command that automatically identifies and extracts all fields from the portion of raw machine data of the event, wherein a particular field is identified for each first text portion separated by one or more designated demarcating characters from a second text portion in the portion of raw machine data.
25. One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:
accessing a set of events in a data store, each event in the set of events including a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment;
automatically identifying a field for the set of events based on determining the portion of raw machine data of an event includes text corresponding to a field label of the field and an associated value; and
based on the identifying of the field, automatically producing values for the field for the set of events using an extraction rule that produces the associated value for the field for the event in association with identifying the field label in text from the portion of raw machine data of the event, wherein the field is assigned a field name used to reference the field and at least some of the values in association with execution of a search query on the set of events, and the field name includes different text than the field label.
26. The non-transitory computer-storage media of claim 25 , wherein the field label is an assigned field name of a different field of the set of events.
27. The non-transitory computer-storage media of claim 25 , wherein the field name of the field includes the field label.
28. The non-transitory computer-storage media of claim 25 , further comprising causing display of at least some of the values in a search interface responsive to the search query, wherein the field name is displayed in association with the at least some of the values.
29. The non-transitory computer-storage media of claim 25 , wherein the identifying the field label in text from the portion of raw machine data of the event comprises applying the extraction rule to the portion of raw machine data of the event.
30. The non-transitory computer-storage media of claim 25 , wherein the identifying the field label in text from the portion of raw machine data of the event comprises applying the extraction rule to a field value of a different field than the field, the field value extracted from the portion of raw machine data of the event.