Previewing raw data parsing

One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause operations comprising:

• accessing a portion of raw data from at least one data source;
• causing display of one or more selectable parsing rules;
• receiving a first user input, from a graphical user interface, selecting a parsing rule among the one or more selectable parsing rules, the parsing rule to be applied to the portion of raw data;
• parsing the portion of raw data into one or more sets of parsed data using the parsing rule, each set of parsed data including raw data from the portion of raw data;
• causing display of at least a portion of the one or more sets of parsed data;
• receiving a second user input, from the graphical user interface, indicating a user preference to use a different parsing rule;
• accessing a second parsing rule;
• processing raw data from the at least one data source using the second parsing rule, to create searchable, time-stamped events, the processed raw data including the portion of raw data and additional raw data different from the portion of raw data;
• and
• storing the searchable, time-stamped events in an index store, wherein the searchable, time-stamped events in the index store are used to service search queries received from a search engine.

An apparatus, comprising:

• a raw data selector, implemented at least partially in hardware, configured to access a portion of raw data from at least one data source;
• a display subsystem, implemented at least partially in hardware, configured to cause display of one or more selectable parsing rules;
• a user input receiver, implemented at least partially in hardware, configured to receive a first user input from a graphical user interface, selecting a parsing rule among the one or more selectable parsing rules, the parsing rule to be applied to the portion of raw data;
• a raw data parser, implemented at least partially in hardware, configured to parse the portion of raw data into one or more sets of parsed data using the parsing rule, each set of parsed data including raw data from the portion of raw data;
• wherein the display subsystem is configured to cause display of at least a portion of the one or more sets of parsed data;
• wherein the user input receiver is configured to receive a second user input, from the graphical user interface, indicating a user preference to use a different parsing rule;
• a parsing rule selector, implemented at least partially in hardware, configured to access a second parsing rule;
• wherein the raw data parser is configured to process, in response to receiving a second user input, raw data from the at least one data source using the second parsing rule, to create searchable, time-stamped events, the processed raw data including the portion of raw data and additional raw data different from the portion of raw data;
• and
• an event storage device, implemented at least partially in hardware, configured to store the searchable, time-stamped events in an index store, wherein the searchable, time-stamped events in the index store are usable to service search queries received from a search engine.