Identifying field values based on user-selected extraction mode

1. A computer-implemented method, comprising:

receiving, via a graphical user interface, a user selection of an extraction mode defining a method of performing extraction to identify values within fields;

identifying a first set of one or more values from a plurality of events based on the selected extraction mode;

identifying a second set of one or more values from the plurality of events based on the selected extraction mode; and

assigning the identified first set of one or more values to a first field and the second set of one or more values to a second field.

2. The computer-implemented method of claim 1 , wherein identifying the first set of one or more values from the plurality of events comprises extracting the first set of one or more values from the plurality of events, and identifying the second set of one or more values from the plurality of events comprises extracting the second set of one or more values from the plurality of events.

3. The computer-implemented method of claim 1 , further comprising:

receiving an indication of a data source;

receiving a selection of a sample event from the plurality of events associated with the data source; and

providing the sample event for display in association with a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode.

4. The computer-implemented method of claim 1 , further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating a preferred mode to use based on the plurality of events.

5. The computer-implemented method of claim 1 , further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating the delimiter mode is a preferred mode based on a determination that the plurality of events includes a consistent number of delimiters and a same type of delimiters.

6. The computer-implemented method of claim 1 , further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating the regular expression mode is a preferred mode based on a determination that the plurality of events does not include a consistent number of delimiters or a same type of delimiters.

7. The computer-implemented method of claim 1 , further comprising:

providing for display of an indication of the first field and the first set of one or more values and an indication of the second field and the second set of one or more values, wherein the first set of one or more values is presented with a value count that indicates a number of instances one of the one or more values in the first set appears in the plurality of events.

8. The computer-implemented method of claim 1 , further comprising:

storing the identified first set of one or more values in association with the first field and the second set of one or more values in association with the second field;

receiving a selection to search the plurality of events; and

in response to receiving the selection to search the plurality of events, providing for display the first field and the second field as options for selections to view data, wherein selection of the first field results in presentation of the first set of one or more values and selection of the second field results in presentation of the second set of one or more values.

9. The computer-implemented method of claim 1 , further comprising:

after assigning the identified first set of one or more values to the first field and the second set of one or more values to the second field, receiving a second user selection to use a regular expression rule to identify substring values within the first set of one or more values of the first field;

receiving an indication of a sample substring value within one of the one or more values within the first set of one or more values;

based on the sample substring value, generating the regular expression rule; and

using the regular expression rule to identify the sub string values within the first set of one or more values of the first field.

10. The computer-implemented method of claim 1 , further comprising:

after assigning the identified first set of one or more values to the first field and the second set of one or more values to the second field, receiving a second user selection to use a delimiter type to identify substring values within the first set of one or more values of the first field;

receiving an indication of the delimiter type within the one or more values within the first set of one or more values; and

using the delimiter type to identify the substring values within the first set of one or more values of the first field.

11. One or more computer-storage media storing computer-useable instructions that, when executed by a computing device, perform operations comprising:

receiving, via a graphical user interface, a user selection of an extraction mode defining a method of performing extraction to identify values within fields;

identifying a first set of one or more values from a plurality of events based on the selected extraction mode;

identifying a second set of one or more values from the plurality of events based on the selected extraction mode; and

assigning the identified first set of one or more values to a first field and the second set of one or more values to a second field.

12. The one or more computer-storage media of claim 11 , wherein identifying the first set of one or more values from the plurality of events comprises extracting the first set of one or more values from the plurality of events, and identifying the second set of one or more values from the plurality of events comprises extracting the second set of one or more values from the plurality of events.

13. The one or more computer-storage media of claim 11 , the operations further comprising:

receiving an indication of a data source;

receiving a selection of a sample event from the plurality of events associated with the data source; and

providing the sample event for display in association with a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode.

14. The one or more computer-storage media of claim 11 , the operations further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating a preferred mode to use based on the plurality of events.

15. The one or more computer-storage media of claim 11 , the operations further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating the delimiter mode is a preferred mode based on a determination that the plurality of events includes a consistent number of delimiters and a same type of delimiters.

16. The one or more computer-storage media of claim 11 , the operations further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating the regular expression mode is a preferred mode based on a determination that the plurality of events does not include a consistent number of delimiters or a same type of delimiters.

17. The one or more computer-storage media of claim 11 , the operations further comprising:

providing for display of an indication of the first field and the first set of one or more values and an indication of the second field and the second set of one or more values, wherein the first set of one or more values is presented with a value count that indicates a number of instances one of the one or more values in the first set appears in the plurality of events.

18. The one or more computer-storage media of claim 11 , the operations further comprising:

storing the identified first set of one or more values in association with the first field and the second set of one or more values in association with the second field;

receiving a selection to search the plurality of events; and

in response to receiving the selection to search the plurality of events, providing for display the first field and the second field as options for selections to view data, wherein selection of the first field results in presentation of the first set of one or more values and selection of the second field results in presentation of the second set of one or more values.

19. The one or more computer-storage media of claim 11 , the operations further comprising:

after assigning the identified first set of one or more values to the first field and the second set of one or more values to the second field, receiving a second user selection to use a regular expression rule to identify substring values within the first set of one or more values of the first field;

receiving an indication of a sample substring value within one of the one or more values within the first set of one or more values;

based on the sample substring value, generating the regular expression rule; and

using the regular expression rule to identify the sub string values within the first set of one or more values of the first field.

20. The one or more computer-storage media of claim 11 , the operations further comprising:

after assigning the identified first set of one or more values to the first field and the second set of one or more values to the second field, receiving a second user selection to use a delimiter type to identify substring values within the first set of one or more values of the first field;

receiving an indication of the delimiter type within the one or more values within the first set of one or more values; and

using the delimiter type to identify the substring values within the first set of one or more values of the first field.

21. A system comprising:

one or more data processors; and

one or more computer-readable storage media containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:

receiving, via a graphical user interface, a user selection of an extraction mode defining a method of performing extraction to identify values within fields;

identifying a first set of one or more values from a plurality of events based on the selected extraction mode;

identifying a second set of one or more values from the plurality of events based on the selected extraction mode; and

assigning the identified first set of one or more values to a first field and the second set of one or more values to a second field.

22. The system of claim 21 , wherein identifying the first set of one or more values from the plurality of events comprises extracting the first set of one or more values from the plurality of events, and identifying the second set of one or more values from the plurality of events comprises extracting the second set of one or more values from the plurality of events.

23. The system of claim 21 , the operations further comprising:

receiving an indication of a data source;

receiving a selection of a sample event from the plurality of events associated with the data source; and

providing the sample event for display in association with a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode.

24. The system of claim 21 , the operations further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating a preferred mode to use based on the plurality of events.

25. The system of claim 21 , the operations further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating the delimiter mode is a preferred mode based on a determination that the plurality of events includes a consistent number of delimiters and a same type of delimiters.

26. The system of claim 21 , the operations further comprising:

providing a first option to select a delimiter mode as the extraction mode and a second option to select a regular expression mode as the extraction mode; and

providing a recommendation indicating the regular expression mode is a preferred mode based on a determination that the plurality of events does not include a consistent number of delimiters or a same type of delimiters.

27. The system of claim 21 , the operations further comprising:

providing for display of an indication of the first field and the first set of one or more values and an indication of the second field and the second set of one or more values, wherein the first set of one or more values is presented with a value count that indicates a number of instances one of the one or more values in the first set appears in the plurality of events.

28. The system of claim 21 , the operations further comprising:

storing the identified first set of one or more values in association with the first field and the second set of one or more values in association with the second field;

receiving a selection to search the plurality of events; and

in response to receiving the selection to search the plurality of events, providing for display the first field and the second field as options for selections to view data, wherein selection of the first field results in presentation of the first set of one or more values and selection of the second field results in presentation of the second set of one or more values.

29. The system of claim 21 , the operations further comprising:

after assigning the identified first set of one or more values to the first field and the second set of one or more values to the second field, receiving a second user selection to use a regular expression rule to identify substring values within the first set of one or more values of the first field;

receiving an indication of a sample substring value within one of the one or more values within the first set of one or more values;

based on the sample substring value, generating the regular expression rule; and

using the regular expression rule to identify the sub string values within the first set of one or more values of the first field.

30. The system of claim 21 , the operations further comprising:

after assigning the identified first set of one or more values to the first field and the second set of one or more values to the second field, receiving a second user selection to use a delimiter type to identify substring values within the first set of one or more values of the first field;

receiving an indication of the delimiter type within the one or more values within the first set of one or more values; and

using the delimiter type to identify the substring values within the first set of one or more values of the first field.