1. A computer-implemented method, comprising: accessing a set of events in a data store, each event in the set of events including a portion of raw machine data that reflects activity in an information technology environment and that is produced by a component of that information technology environment; automatically identifying a field for the set of events based on determining the portion of raw machine data of a first event includes text corresponding to a field label of the field and an associated value; and defining the identified field by an extraction rule for producing a first value for the identified field for a second event in association with a first occurrence of the field label in the portion of raw machine data of the second event, wherein a second value is not produced for the field in association with a second occurrence of the field label in the portion of raw machine data.