Time-based visualization of the number of events having various values for a field

A non-transitory computer readable medium storing instructions that, when executed by a computer, cause the computer to perform functions to:

• receiving a first user input via a graphical user interface, the input specifying a field and a time range;
• identifying a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;
• determining a set of unique values for the field from the identified set of events;
• for each unique value in the set of unique values, identifying a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;
• determining whether the set of unique values can be treated numerically;
• in response to determining that the set of unique values can not be treated numerically, causing display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;
• in response to determining that the set of unique values can be treated numerically, causing display of a scatter plot visualization.

A system comprising:

• a memory having processor-readable instructions stored therein;
• and
• a processor configured to access the memory and execute the processor-readable instructions, which when executed by the processor, configures the processor to perform a plurality of functions, including functions to:
• receive a first user input via a graphical user interface, the input specifying a field and a time range;
• identify a set of events based on searching a plurality of events in a data store using the first user input, the plurality of events segmented from machine data by determining beginning and ending of each event in the plurality of events in the machine data, each event in the plurality set of events having a time stamp and including a sub-portion of machine data segmented for that event, each event in the identified set occurring within the time range and including a value for the specified field that is extracted using an extraction rule from the sub-portion of machine data in that event;
• determine a set of unique values for the field from the identified set of events;
• for each unique value in the set of unique values, identify a subset of events including that unique value for the field, the time stamp for each event in the identified subset coinciding with one of a plurality of time slots within the time range;
• determine whether the set of unique values can be treated numerically;
• in response to determining that the set of unique values can not be treated numerically, cause display of a set of rows intersecting with a set of columns, each row corresponding to one unique value in the set of unique values, each column corresponding to one of the plurality of time slots, and each intersection of a row and a column providing an indication of a number of events including the unique value corresponding to the row and having a time stamp coinciding with the time slot corresponding to the column;
• in response to determining that the set of unique values can be treated numerically, cause display of a scatter plot visualization.