Creating a time series based on event data

A system comprising:

• one or more processors configured to:
• receive data from one or more host devices, wherein the data includes log data;
• generate enterprise events from the data, wherein individual ones of the enterprise events include fields having associated values, the associated values including a time value that indicates a time that the data corresponding to an individual one of the enterprise events was created;
• identify one or more enterprise events of interest within the enterprise events;
• generate one or more observability events based on the one or more enterprise events of interest, wherein the generating comprises extracting the time value and at least a portion of the associated values from the one or more enterprise events of interest;
• and
• add an alert identifier to the one or more observability events, wherein the alert identifier indicates a type of alert associated with the one or more observability events.

A non-transitory computer-readable medium storing a set of instructions, the set of instructions when executed by one or more processors cause processing to be performed comprising:

• receiving, by one or more computer systems, data from one or more host devices, wherein the data includes log data;
• generating, by the one or more computer systems, enterprise events from the data, wherein individual ones of the enterprise events include fields having associated values, the associated values including a time value that indicates a time that the data corresponding to an individual one of the enterprise events was created;
• identifying, by the one or more computer systems, one or more enterprise events of interest within the enterprise events;
• generating, by the one or more computer systems, one or more observability events based on the one or more enterprise events of interest, wherein the generating comprises extracting the time value and at least a portion of the associated values from the one or more enterprise events of interest;
• and
• adding, by the one or more computer systems, an alert identifier to the one or more observability events, wherein the alert identifier indicates a type of alert associated with the one or more observability events.