Automatic entity definitions based on derived content

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• identify an undefined entity by applying, to machine data, a data selection query specifying a relationship between two or more data items in the machine data, wherein the entity generates particular data items included in the machine data as part of performing a service, and wherein the entity is identified by the data selection query as a result of the entity having generated particular two or more data items that have the relationship;
• determine, using the particular two or more data items, that a plurality of stored entity definitions does not include a definition for the entity such that the entity is an undefined entity;
• execute a search query on the machine data to determine content descriptive of the undefined entity;
• generate an entity definition for the undefined entity using the content descriptive of the entity;
• identify the service performed by the undefined entity based on the entity definition matching an association rule specified by a service definition of the service, wherein the service definition specifies one or more entity definitions of entities providing the service and defines relationships between one or more entities referenced by the one or more entity definitions;
• associate the entity definition with the service definition;
• and
• store the entity definition with the plurality of stored entity definitions.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the processing devices to perform operations comprising:

• identifying an undefined entity by applying, to machine data, a data selection query specifying a relationship between two or more data items in the machine data, wherein the entity generates particular data items included in the machine data as part of performing a service, and wherein the entity is identified by the data selection query as a result of the entity having generated particular two or more data items that have the relationship;
• determining, using the particular two or more data items, that a plurality of stored entity definitions does not include a definition for the entity such that the entity is an undefined entity;
• executing a search query on the machine data to determine content descriptive of the undefined entity;
• generating an entity definition for the undefined entity using the content descriptive of the entity;
• identifying the service performed by the undefined entity based on the entity definition matching an association rule specified by a service definition of the service, wherein the service definition specifies one or more entity definitions of entities providing the service and defines relationships between one or more entities referenced by the one or more entity definitions;
• associating the entity definition with the service definition;
• and
• storing the entity definition with the plurality of stored entity definitions.