Machine data web

A computer-implemented method for creating a machine data web of events comprising:

• obtaining events by a computer, the events representing units of system activity of one or more data sources;
• creating, by the computer, a co-occurrence table of the events;
• creating, by the computer, dynamic links between the events based on the co-occurrence table if the events co-occur more frequently than a predetermined frequency and a distance between the events is less than a predetermined distance;
• and
• chaining, by the computer, the linked events to create a transitive path of linked events, each link in the path sharing a common event with an adjacent link in the path.

A system for organizing machine data into events, the system comprising:

• a non-transitory computer-readable storage medium storing executable computer-program instructions comprising a machine data organization module for:
• collecting machine data;
• classifying the collected machine data into domains based on source signatures for the domains, the source signatures previously created from samples of machine data from known domains and based on functions of punctuation in the samples of machine data;
• automatically learning break rules for each domain based on the collected machine data from that domain, at least one of the rules indicating when multiple lines of machine data represent a single event;
• and
• on a domain by domain basis, aggregating the collected machine data into events based on the learned break rules.

A non-transitory computer readable medium containing instructions to cause processor(s) to execute instructions to carry out a method for organizing machine data into events, the method comprising:

• collecting machine data;
• classifying the collected machine data into domains based on source signatures for the domains, the source signatures previously created from samples of machine data from known domains and based on functions of punctuation in the samples of machine data;
• automatically learning break rules for each domain based on the collected machine data from that domain, at least one of the rules indicating when multiple lines of machine data represent a single event;
• and
• on a domain by domain basis, aggregating the collected machine data into events based on the learned break rules.