Providing field extraction recommendations for display

1. A computer-implemented method, comprising:

causing display of a set of events, each event in the set of events comprising a time-stamped portion of raw machine data, the raw machine data produced by one or more components within an information technology environment and reflecting activity within the information technology or security environment;

receiving an indication to view field extraction recommendations; and

causing display of a set of field extraction recommendations, each field extraction recommendation comprising a set of variable text identified, via a neural network, within a corresponding event, wherein the set of variable text is identified based on using a probability of a next character, given a previous set of characters in the corresponding event, to identify when the set of variable text begins or ends within the corresponding event.

2. The computer-implemented method of claim 1 , wherein the set of events correspond with a source type and the neural network is generated in accordance with a set of training events corresponding with the source type.

3. The computer-implemented method of claim 1 , further comprising training the neural network.

4. The computer-implemented method of claim 1 , further comprising training the neural network, wherein the neural network is trained by:

obtaining a set of training events comprising character strings;

providing the character strings to the neural network on a character-by-character basis;

for each provided character, predicting a next character; and

training the neural network based on a comparison of the predicted next character to an actual next character.

5. The computer-implemented method of claim 1 , wherein the neural network is used to automatically identify a first set of variable text by:

providing a first event to the neural network on a character-by-character basis;

for each character provided to the neural network, identifying a first probability of a next character of the first event given previous characters of the first event;

analyzing a sequence of the probabilities to identify a deviation in the probabilities; and

utilizing the deviation in the probabilities to identify the first set of variable text.

6. The computer-implemented method of claim 1 , wherein the neural network is used to automatically identify a first set of variable text by:

providing a first event as character strings to the neural network on a character-by-character basis;

for each character provided to the neural network, identifying a first probability of a next character of the first event given previous characters of the first event;

analyzing a sequence of the probabilities to identify a first probability that falls below a threshold value; and

designating the character associated with the first probability as a beginning character of the first set of variable text.

7. The computer-implemented method of claim 1 further comprising using a second neural network to automatically identify a first set of variable text, wherein the neural network is trained in a forward character-by-character basis, and the second neural network is trained in a reverse character-by-character basis.

8. The computer-implemented method of claim 1 , further comprising using a second neural network to automatically identify a first set of variable text, wherein a character string of a first event is provided to the neural network in a forward manner beginning with the first character of the character string, and the character string is provided to the second neural network in a reverse manner beginning with the last character of the character string.

9. The computer-implemented method of claim 1 , further comprising using a second neural network to automatically identify a first set of variable text, the second neural network being trained by:

obtaining a set of training events comprising character strings;

providing the character strings to the second neural network on a character-by-character basis beginning with last characters of the character strings;

for each provided character, predicting a next character; and

training the second neural network based on a comparison of the predicted next character to an actual next character.

10. The computer-implemented method of claim 1 , further comprising using a second neural network to automatically identify a first set of variable text by:

providing a first event to the second neural network on a character-by-character basis beginning with a last character;

for each character provided to the second neural network, identifying a probability of a next character given the previous characters;

analyzing a sequence of the probabilities to identify a deviation in the probabilities; and

utilizing the deviation in the probabilities to identify the first set of variable text.

11. The computer-implemented method of claim 1 , further comprising using a second neural network to automatically identify a first set of variable text by:

providing a first event to the second neural network on a character-by-character basis beginning with a last character;

for each character provided to the second neural network, identifying a probability of a next character given the previous characters;

analyzing a sequence of the probabilities to identify a first probability that falls below a threshold value; and

designating the character associated with the first probability as an ending character of the first set of variable text.

12. The computer-implemented method of claim 1 , further comprising using a second neural network to automatically identify a first set of variable text, wherein the neural network is used to identify a beginning of the first set of variable text, and the second neural network is used to identify an ending of the first set of variable text.

13. The computer-implemented method of claim 1 , further comprising generating an extraction rule to extract a first set of variable text.

14. The computer-implemented method of claim 1 , further comprising:

receiving a selection of a field extraction recommendation; and

providing a preview of field values to be extracted in accordance with the field extraction recommendation.

15. The computer-implemented method of claim 1 , further comprising:

receiving a selection of a field extraction recommendation; and

based on the selection, initiating a corresponding field extraction.

16. The computer-implemented method of claim 1 , wherein the probability of the next character given the previous set of characters is used to identify when the set of variable text beings or ends based on a deviation of the probability exceeding a threshold relative to at least one other probability associated with another character in the corresponding event.

17. A system comprising:

one or more processors; and

computer memory having instructions stored thereon, the instructions, when executed by the one or more processors causing the system to perform a method comprising:

causing display of a set of events, each event in the set of events comprising a time-stamped portion of raw machine data, the raw machine data produced by one or more components within an information technology environment and reflecting activity within the information technology or security environment;

receiving an indication to view field extraction recommendations; and

causing display of a set of field extraction recommendations, each field extraction recommendation comprising a set of variable text identified, via a neural network, within a corresponding event, wherein the set of variable text is identified based on using a probability of a next character, given a previous set of characters in the corresponding event, to identify when the set of variable text begins or ends within the corresponding event.

18. The system of claim 17 , further comprising training the neural network, wherein the neural network is trained by:

obtaining a set of training events comprising character strings;

providing the character strings to the neural network on a character-by-character basis;

for each provided character, predicting a next character; and

training the neural network based on a comparison of the predicted next character to an actual next character.

19. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause performance of:

causing display of a first display portion including a set of events, each event in the set of events comprising a time-stamped portion of raw machine data, the raw machine data produced by one or more components within an information technology or security environment and reflecting activity within the information technology or security environment; and

causing display of a second display portion including a set of field extraction recommendation displayed in response to receiving an indication to view field extraction recommendations, each field extraction recommendation comprising a set of variable text identified, via a neural network, within a corresponding event, wherein the set of variable text is identified based on using a probability of a next character given a previous set of characters in the corresponding event, to identify when the set of variable text begins or ends within the corresponding event.

20. The one or more non-transitory computer-readable media of claim 19 , further comprising causing display of a third display portion including a preview of field values to be extracted in accordance with a selected field extraction recommendation.