Real Time Indication Of Previously Extracted Data Fields For Regular Expressions

An apparatus, comprising:

• a subsystem, on a first device, implemented at least partially in hardware, that organizes machine data into a plurality of events;
• a subsystem, implemented at least partially in hardware, that automatically generates at least one extraction rule based on a value selected from machine data in an event among the plurality of events;
• a subsystem, implemented at least partially in hardware, that extracts at least one value from at least one event in the plurality of events using the at least one extraction rule.

A non-transitory computer-readable medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

• organizing, on a first device, machine data into a plurality of events;
• automatically generating at least one extraction rule based on a value selected from machine data in an event among the plurality of events;
• extracting at least one value from at least one event in the plurality of events using the at least one extraction rule.