Source differentiation of machine data

One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:

• analyzing one or more punctuation characters that appear in a portion of a set of machine data;
• mapping the one or more punctuation characters to a frequency of occurrence in the portion of the set of machine data;
• creating a sample signature using the frequency of occurrence of the one or more punctuation characters;
• determining a source of the set of machine data based on a comparison of the sample signature with signatures in a set of signatures from known sources;
• segmenting the machine data into a plurality of events using a set of rules corresponding to the determined source thereby allowing application of time-based search phrases across the segmented machine data in the plurality of events.

An apparatus, comprising:

• a signature creation device, implemented at least partially in hardware, that analyzes one or more punctuation characters that appear in a portion of a set of machine data;
• wherein the signature creation device maps the one or more punctuation characters to a frequency of occurrence in the portion of the set of machine data;
• wherein the signature creation device creates a sample signature using the frequency of occurrence of the one or more punctuation characters;
• a signature comparison device, implemented at least partially in hardware, that determines a source of the set of machine data based on a comparison of the sample signature with signatures in a set of signatures from known sources;
• an event creation device, implemented at least partially in hardware, that segments the machine data into a plurality of events using a set of rules corresponding to the determined source thereby allowing application of time-based search phrases across the segmented machine data in the plurality of events.