Facilitating custom content extraction rule configuration for remote capture agents

A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors, cause performance of operations comprising:

• receiving, via a graphical user interface (GUI), input defining a custom content extraction rule, wherein the input specifies:
• a source field in network packets to be monitored by a remote capture agent, the source field containing structured data,
• second input specifying an extraction rule to be used to extract data from the structured data to obtain extracted data, and
• a field name to be used to identify the extracted data in timestamped events to be generated by the remote capture agent;
• generating configuration information based on the input;
• sending the configuration information to the remote capture agent, wherein the configuration information causes the remote capture agent to generate timestamped events, wherein the timestamped events include extracted data obtained by applying the custom content extraction rule to network packets monitored by the remote capture agent, and wherein the extracted data is identified in the timestamped events using the field name
• receiving the timestamped events from the remote capture agent, wherein each of the timestamped events includes extracted data identified by the field name;
• and
• storing the timestamped events in a data store, wherein storage of the timestamped events in the data store enables execution of queries based on the field name.

An apparatus, comprising:

• one or more processors;
• a non-transitory computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the apparatus to:
• receive, via a graphical user interface (GUI), input defining a custom content extraction rule, wherein the input specifies:
• a source field in network packets to be monitored by a remote capture agent, the source field containing structured data,
• an extraction rule to be used to extract data from the structured data to obtain extracted data, and
• a field name to be used to identify the extracted data in timestamped events to be generated by the remote capture agent;
• generate configuration information based on the input;
• send the configuration information to the remote capture agent, wherein the configuration information causes the remote capture agent to generate timestamped events, wherein the timestamped events include extracted data obtained by applying the custom content extraction rule to network packets monitored by the remote capture agent, and wherein the extracted data is identified in the timestamped events using the field name
• receive the timestamped events from the remote capture agent, wherein each of the timestamped events includes extracted data identified by the field name;
• and
• store the timestamped events in a data store, wherein storage of the timestamped events in the data store enables execution of queries based on the field name.