Performing data extraction using modified extraction rules

A system comprising:

• at least one network device, comprising:
• a processor;
• and
• a non-transitory computer-readable storage medium containing instructions configured to cause the processor to perform operations including:
• selecting a portion of raw data from at least one data source;
• causing display of an extraction rule associated with the portion of raw data from the at least one data source;
• extracting at least one value from the portion of raw data using the extraction rule;
• causing display, via a graphical user interface, of a plurality of searchable, time stamped event records and the at least one value extracted from the portion of raw data based on the extraction rule, the at least one value displayed via a particular searchable, time-stamped event record among the plurality of searchable, time-stamped events records, wherein each searchable, time-stamped event record includes a corresponding time-stamp and plurality of field values;
• and
• in response to user input received via the graphical user interface, processing first raw data from the at least one data source using a modified extraction rule to perform data extraction in association with the first raw data including at least some data associated with at least two of the displayed plurality of searchable, time-stamped event records.

A computer-program product, tangibly embodied in a non-transitory machine-readable medium, including instructions configured to cause a data processing apparatus to:

• select a portion of raw data from at least one data source;
• cause display of an extraction rule associated with the portion of raw data from the at least one data source;
• extract at least one value from the portion of raw data using the extraction rule;
• cause display, via a graphical user interface, of a plurality of searchable, time stamped event records and the at least one value extracted from the portion of raw data based on the extraction rule, the at least one value displayed via a particular searchable, time-stamped event record among the plurality of searchable, time-stamped events records, wherein each searchable, time-stamped event record includes a corresponding time-stamp and plurality of field values;
• and
• in response to user input received via the graphical user interface, process first raw data from the at least one data source using a modified extraction rule to perform data extraction in association with the first raw data including at least some data associated with at least two of the displayed plurality of searchable, time-stamped event records;
• wherein the method is performed by one or more computing devices.