Extraction rule generation using clustering

This invention describes a method for automatically creating rules to pull specific pieces of information, like timestamps or error codes, from large streams of raw machine data. It works by first identifying individual data events and then grouping similar events together. For each group, it tries to generate rules to extract the desired information, and if those rules aren't perfect, it refines the groups until it finds a set of rules that reliably extracts the data.