Distinguishing between fields in field value extraction

A computer-implemented system comprising:

• one or more processors;
• and
• one or more computer-storage media storing computer-useable instructions that, when executed by the one or more processors, cause the one or more processors to perform a method, the method comprising:
• accessing a set of events in a data store, each event in the set of events including a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment;
• identifying a field label and a value associated with the field label based on determining the portion of raw machine data of an event includes text corresponding to the field label and the value, the field label being previously assigned a first field of the set of events;
• and
• based on the field label being previously assigned to the first field of the set of events, assigning the value to a second field associated with a new column of a table format and generating a field name for the second field to include the field label and additional text, wherein the generated field name is used as a column label for the new column in the table format to indicate a source of values for the second field and is used to reference the second field in association with execution of a query on the set of events.

One or more non-transitory computer-storage media storing computer-useable instructions that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:

• accessing a set of events in a data store, each event in the set of events including a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment;
• identifying a field label and a value associated with the field label based on determining the portion of raw machine data of an event includes text corresponding to the field label and the value, the field label being previously assigned a first field of the set of events;
• and
• based on the field label being previously assigned to the first field of the set of events, assigning the value to a second field associated with a new column of a table format and generating a field name for the second field to include the field label and additional text, wherein the generated field name is used as a column label for the new column in the table format to indicate a source of values for the second field and is used to reference the second field in association with execution of a query on the set of events.