Field Extraction Rules from Clustered Data Samples

A system comprising:

• a memory;
• and
• a processing device coupled with the memory to:
• receive a sample of source data representative of machine data produced by a data source, the machine data comprising event segments;
• identify a plurality of event segments of the sample;
• classify the event segments into two or more groups based at least in part on a determination of similarity;
• determine automatically, for each of the groups, an extraction rule to extract a common set of one or more fields from each event segment of the group;
• and
• store the extraction rules in computer memory.

A non-transitory computer readable storage medium encoding instructions thereon that, in response to execution by one or more processing devices, cause the one or more processing devices to perform operations comprising:

• receiving a sample of source data representative of machine data produced by a data source, the machine data comprising event segments;
• identifying a plurality of event segments of the sample;
• classifying the event segments into two or more groups based at least in part on a determination of similarity;
• determining automatically, for each of the groups, an extraction rule to extract a common set of one or more fields from each event segment of the group;
• and
• storing the extraction rules in computer memory.