Techniques for generating structured metrics from ingested events

A data intake and query system comprising:

• a processor;
• and
• a memory having instructions executable by the processor to cause the data intake and query system to:
• ingest data including raw data obtained over a computer network from a plurality of remote computer systems;
• generate a plurality of events, wherein each event includes a segment of the raw data and a respective timestamp;
• index the plurality of events to produce a plurality of indexed events;
• extract a first field value from at least a first portion of the raw data of one of the plurality of indexed events, the first field value including a first numerical value indicative of a first measured characteristic of a computing device;
• generate a first structured metric including the first numerical value and a first dimension associated with the first numerical value;
• extract a second field value from at least a second portion of the raw data of another of the plurality of indexed events, the second field value including a second numerical value indicative of a second measured characteristic of a computing device;
• generate a second structured metric including the second numerical value and a second dimension associated with the second numerical value;
• and
• index the first structured metric and the second structured metric.

A non-transitory storage medium storing program instructions, execution of which in a data intake and query system causes actions comprising:

• ingesting data including raw data obtained over a computer network from a plurality of remote computer systems;
• generating a plurality of events, wherein each event includes a segment of the raw data and a respective timestamp;
• indexing the plurality of events to produce a plurality of indexed events;
• extracting a first field value from at least a first portion of the raw data of one of the plurality of indexed events, the first field value including a first numerical value indicative of a first measured characteristic of a computing device;
• generating a first structured metric including the first numerical value and a first dimension associated with the first numerical value;
• extracting a second field value from at least a second portion of the raw data of another of the plurality of indexed events, the second field value including a second numerical value indicative of a second measured characteristic of a computing device;
• generating a second structured metric including the second numerical value and a second dimension associated with the second numerical value;
• and
• indexing the first structured metric and the second structured metric.