Patent Document ID: 9753909
Application ID: 14610668

Base Claim:
1. A computer-implemented method comprising: accessing in memory a set of events each event identified by an associated time stamp; wherein each event in the set of events includes a portion of raw data; causing display of a first user interface including a plurality of events; receiving data indicating selection of a first event from among the plurality of events; causing display of a second user interface presenting the first event to be used to define field extraction; receiving data indicating a selection of one or more portions of text within the first event to be extracted as one or more fields; automatically determining at least one field extraction rule that extracts one or more values for the one or more fields from the respective selections of the portions of text within the events when the extraction rule is applied to the events; causing display of a third user interface including an annotated version of the plurality of events, wherein the annotated version indicates the portions of text within the plurality of events extracted by the field extraction rule and presenting a second event to be used to refine field extraction; and receiving further data indicating a selection of at least one portion of text within the second event to be extracted as into at least one of the fields by at least one updated field extraction rule.

---

Claim 15:
15. The method of claim 1 , further including: the second user interface providing tools that implement user selection of among the fields; receiving further data indicating a selection of a selected field; and transmitting data for a frequency display of values of the selected field extracted from a sample of the events, wherein the frequency display includes a list of values extracted and for each value in the list a frequency and an active filter control, wherein the active filter control filters events to be displayed based on a selected value.