Selection of a representative data subset of a set of unstructured data

A non-transitory, machine-readable storage medium storing instructions, execution of which in a computer system causes the computer system to perform operations comprising:

• retrieving a plurality of events from a data source in accordance with a selected data subset type of a plurality of defined, user-selectable data subset types, wherein the selected data subset type is a combination of at least two of the plurality of defined, user-selectable data subset types;
• identifying similarity between two or more of the retrieved events;
• determining whether any of the retrieved events form a group, based on the identified similarity;
• selecting, based on a determination that two or more of the retrieved events form a group, at least a subset of the retrieved events that form the group, as a representative data subset;
• and
• causing display of the selected events in a user interface as the representative data subset, wherein said causing display comprises causing display of the selected events in a user interface that enables development of a field extraction rule that specifies how to extract a value for a field from information in one or more events.

A computer system comprising:

• a data store to store data;
• and
• a processor coupled to the data store and configured to perform or cause operations that include
• retrieving a plurality of events from a data source in accordance with a selected data subset type of a plurality of defined, user-selectable data subset types, wherein the selected data subset type is a combination of at least two of the plurality of defined, user-selectable data subset types;
• identifying similarity between two or more of the retrieved events;
• determining whether any of the retrieved events form a group, based on the identified similarity;
• selecting, based on a determination that two or more of the retrieved events form a group, at least a subset of the retrieved events that form the group, as a representative data subset;
• and
• causing display of the selected events in a user interface as the representative data subset, wherein said causing display comprises causing display of the selected events in a user interface that enables development of a field extraction rule that specifies how to extract a value for a field from information in one or more events.