Assigning field values based on an identified extraction rule

1. A computer-implemented method comprising:

receiving, by a first computng device, via a graphical user interface, first input identifying, from a plurality of options comprising a delimiter mode and a regular expression mode, a selected extraction mode that defines at least a portion of how to extract values from fields of events;

receiving, by the first computing device, via the graphical user interface, second input configuring an extraction rule that defines at least a first field of the fields based on the selected extraction mode; and

extracting, by the first computing device, a first set of the values from the events into the first field based on the selected extraction rule.

2. The computer-implemented method of claim 1 , wherein the selected extraction mode is the regular expression mode, wherein the second input configuring the extraction rule comprises a selection of a sample value of a sample event of the events, the sample value indicating a location of the first field in the sample event, the method further comprising generating the extraction rule as a regular expression that specifies extraction of the sample value from the first field.

3. The computer-implemented method of claim 1 , wherein the selected extraction mode is the regular expression mode, the method further comprising causing the graphical user interface to present a set of the events with a representation of a sample extraction from locations in the set of the events corresponding to the first field.

4. The computer-implemented method of claim 1 , wherein the selected extraction mode is the regular expression mode, wherein the second input configuring the extraction rule comprises a selection of a sample value of a sample event of the events, the sample value indicating a location of the first field in the sample event, the method further comprising:

causing the graphical user interface to present a set of the events with a representation of a sample extraction of sample extracted values from locations in the set of the events corresponding to the first field;

receiving a third input identifying one of the sample extracted values as an undesired sample value; and

generating the extraction rule as a regular expression that specifies extraction of the sample value, but not the undesired sample value, from the first field.

5. The computer-implemented method of claim 1 , wherein the selected extraction mode is the delimiter mode, wherein the second input configuring the extraction rule comprises a selection of a type of delimiter, the method further comprising generating the extraction rule specifying that the fields are separated by boundaries identified by instances of the type of delimiter specified by the selection.

6. The computer-implemented method of claim 1 , wherein the selected extraction mode is the delimiter mode, wherein the second input configuring the extraction rule comprises a selection of a type of delimiter, the method further comprising:

causing the graphical user interface to present a set of the events with a representation of the fields identified using the type of delimiter specified by the selection; and

receiving a representation of one or more field names for the fields identified using the type of delimiter specified by the selection.

7. The computer-implemented method of claim 1 , further comprising causing the graphical user interface to present a sample event of the events while receiving the first input identifying the selected extraction mode.

8. One or more computer-storage media storing computer-useable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving, by the first computing device, via a graphical user interface, first input identifying, from a plurality of options comprising a delimiter mode and a regular expression mode, a selection extraction mode that defines at least a portion of how to extract values from fields of events;

receiving, by the first computing device, via the graphical user interface, second input configuring an extraction rule that defines at least a first field of the fields based on the selected extraction mode; and

extracting, by the first computing device, a first set of the values from the events to the first field based on the extraction rule.

9. The one or more computer-storage media of claim 8 , wherein the selected extraction mode is the regular expression mode, wherein the second input configuring the extraction rule comprises a selection of a sample value of a sample event of the events, the sample value indicating a location of the first field in the sample event, the operations further comprising generating the extraction rule as a regular expression that specifies extraction of the sample value from the first field.

10. The one or more computer-storage media of claim 8 , wherein the selected extraction mode is the regular expression mode, the operations further comprising causing the graphical user interface to present a set of the events with a representation of a sample extraction from locations in the set of the events corresponding to the first field.

11. The one or more computer-storage media of claim 8 , wherein the selected extraction mode is the regular expression mode, wherein the second input configuring the extraction rule comprises a selection of a sample value of a sample event of the events, the sample value indicating a location of the first field in the sample event, the operations further comprising:

causing the graphical user interface to present a set of the events with a representation of a sample extraction of sample extracted values from locations in the set of the events corresponding to the first field;

receiving a third input identifying one of the sample extracted values as an undesired sample value; and

generating the extraction rule as a regular expression that specifies extraction of the sample value, but not the undesired sample value, from the first field.

12. The one or more computer-storage media of claim 8 , wherein the selected extraction mode is the delimiter mode, wherein the second input configuring the extraction rule comprises a selection of a type of delimiter, the operations further comprising generating the extraction rule specifying that the fields are separated by boundaries identified by instances of the type of delimiter specified by the selection.

13. The one or more computer-storage media of claim 8 , wherein the selected extraction mode is the delimiter mode, wherein the second input configuring the extraction rule comprises a selection of a type of delimiter, the operations further comprising:

causing the graphical user interface to present a set of the events with a representation of the fields identified using the type of delimiter specified by the selection; and

receiving a representation of one or more field names for the fields identified using the type of delimiter specified by the selection.

14. The one or more computer-storage media of claim 8 , the operations further comprising causing the graphical user interface to present a sample event of the events while receiving the first input identifying the selected extraction mode.

15. A system comprising:

one or more data processors; and

one or more computer-storage media storing computer-useable instructions that, when executed by the one or more data processors, cause the one or more data processors to perform operations comprising:

receiving, by a first computing device, via a graphical user interface, first input identifying, from a plurality of options comprising a delimiter mode and a regular expression mode, a selected extraction mode that defines at least a portion of how to extract values from fields of events;

receiving, by the first computing device, via the graphical user interface, second input configuring an extraction rule that defines at least a first field of the fields based on the selected extraction mode; and

extracting, by the first computing device, a first set of the values from the events into the first field based on the extraction rule.

16. The system of claim 15 , wherein the selected extraction mode is the regular expression mode, wherein the second input configuring the extraction rule comprises a selection of a sample value of a sample event of the events, the sample value indicating a location of the first field in the sample event, the operations further comprising generating the extraction rule as a regular expression that specifies extraction of the sample value from the first field.

17. The system of claim 15 , wherein the selected extraction mode is the regular expression mode, the operations further comprising causing the graphical user interface to present a set of the events with a representation of a sample extraction from locations in the set of the events corresponding to the first field.

18. The system of claim 15 , wherein the selected extraction mode is the regular expression mode, wherein the second input configuring the extraction rule comprises a selection of a sample value of a sample event of the events, the sample value indicating a location of the first field in the sample event, the operations further comprising:

causing the graphical user interface to present a set of the events with a representation of a sample extraction of sample extracted values from locations in the set of the events corresponding to the first field;

receiving a third input identifying one of the sample extracted values as an undesired sample value; and

generating the extraction rule as a regular expression that specifies extraction of the sample value, but not the undesired sample value, from the first field.

19. The system of claim 15 , wherein the selected extraction mode is the delimiter mode, wherein the second input configuring the extraction rule comprises a selection of a type of delimiter, the operations further comprising generating the extraction rule specifying that the fields are separated by boundaries identified by instances of the type of delimiter specified by the selection.

20. The system of claim 15 , wherein the selected extraction mode is the delimiter mode, wherein the second input configuring the extraction rule comprises a selection of a type of delimiter, the operations further comprising:

causing the graphical user interface to present a set of the events with a representation of the fields identified using the type of delimiter specified by the selection; and

receiving a representation of one or more field names for the fields identified using the type of delimiter specified by the selection.