US Patent 11526482 Determining timestamps to be associated with events in machine data

Methods and apparatus are disclosed to automatically timestamp events within streaming machine data. The streaming machine data is broken into a set of events using breaking rules. Each event can be analyzed by iterating over own time stamp format patterns from a list of known time stamp format patterns to determine whether a matching pattern exists in the event. When an individual event broken out from the streaming machine data includes time information according to at least one known time stamp format pattern of the list of known time stamp format patterns, a timestamp can be created for the event by extracting a time value from event ng the matching pattern determined to exist in the event.