Modifying field definitions to include post-processing instructions

One or more non-transitory computer-readable medium, storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

• causing a user interface to be displayed that displays a list of a plurality of templates, each template of the plurality of templates including a set of rules for parsing fields from log files, each of the log files including raw data corresponding to a data item of a set of data items;
• receiving a selection of a particular template from the list of the plurality of templates;
• identifying at least one sample data item;
• causing display of a preview of a set of field values with associated field names, the preview graphically depicting a segmentation of the set of field values with the associated field names, the set of field values and the associated field names parsed from the at least one sample data item using index positions and delimiters corresponding to respective associated field names included in a respective set of rules of the particular template;
• causing display of a post-processing control;
• receiving an input, via the post-processing control, to define a post-processing instruction in association with a particular field corresponding with a field value of the set of field values;
• based on receiving the input, updating the particular template to create an updated rule from among the respective set of rules that is associated with the particular field corresponding with the field value, the updated rule including the post-processing instruction.

An apparatus, comprising:

• one or more processors;
• and
• one or more memory devices storing instructions, which when executed by the one or more processors, cause the one or more processors to:
• cause a user interface to be displayed that displays a list of a plurality of templates, each template of the plurality of templates including a set of rules for parsing fields from log files, each of the log files including raw data corresponding to a data item of a set of data items;
• receive a selection of a particular template from the list of the plurality of templates;
• identify at least one sample data item;
• cause display of a preview of a set of field values with associated field names, the preview graphically depicting a segmentation of the set of field values with the associated field names, the set of field values and the associated field names parsed from the at least one sample data item using index positions and delimiters corresponding to respective associated field names included in a respective set of rules of the particular template;
• cause display of a post-processing control;
• receive an input, via the post-processing control, to define a post-processing instruction in association with a particular field corresponding with a field value of the set of field values;
• based on receiving the input, update the particular template to create an updated rule from among the respective set of rules that is associated with the particular field corresponding with the field value, the updated rule including the post-processing instruction.