Identifying events derived from machine data that match a particular portion of machine data

One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:

• analyzing machine data stored in at least one storage device in order to segment the machine data into a plurality of events by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality of events including some machine data from the stored machine data segmented for that event, the plurality of events including both events produced from a first data resource and events produced from a second data resource that is different from the first data resource, the machine data in one or more events produced from the first data resource having a different data format than the machine data in one or more events produced from the second data resource;
• identifying, in the plurality of events, one or more events that include a particular portion of machine data.

An apparatus, comprising:

• a subsystem, implemented at least partially in hardware, that analyzes machine data stored in at least one storage device in order to segment the machine data into a plurality of events by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality of events including some machine data from the stored machine data segmented for that event, the plurality of events including both events produced from a first data resource and events produced from a second data resource that is different from the first data resource, the machine data in one or more events produced from the first data resource having a different data format than the machine data in one or more events produced from the second data resource;
• a subsystem, implemented at least partially in hardware, that identifies, in the plurality of events, one or more events that include a particular portion of machine data.