Patent Document ID: 8909642
Application ID: 13748306

Base Claim:
1. A computer-implemented method comprising: accessing in memory a set of events, each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data from machine data; transmitting for display a user interface including a first event and a plurality of second events of the set of events; receiving data indicating a selection of a portion of text within the first event; automatically determining a field extraction rule that extracts as a value of a field the selection of the portion of text within the first event when the field extraction rule is applied to the first event; and transmitting for display an updated user interface that includes the second events and that indicates, for each of the second events, a value of the field for each second event that would be extracted by applying the extraction rule to the second event.

---

Claim 30:
30. The method of claim 1 , further comprising: receiving an indication that a value is to serve as a counter example for the field; and modifying the field extraction rule to bias against identifying the counter-example value as a value for the field.