Embodiments are directed towards the visualization of machine data received from computing clusters. Embodiments may enable improved analysis of computing cluster performance, error detection, troubleshooting, error prediction, or the like. Individual cluster nodes may generate machine data that includes information and data regarding the operation and status of the cluster node. The machine data is received from each cluster node for indexing by one or more indexing applications. The indexed machine data including the complete data set may be stored in one or more index stores. A visualization application enables a user to select one or more analysis lenses that may be used to generate visualizations of the machine data. The visualization application employs the analysis lens to produce visualizations of the computing cluster machine data.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A computer-implemented method comprising: receiving machine data from a computing cluster, the computing cluster including a plurality of computational nodes; generating a plurality of time stamped events from the received machine data, each time stamped event having a time stamp derived from data parsed from the received machine data; analyzing data in a subset of events in the plurality of time stamped events using heuristic analysis to identify an occurrence of an event pattern that is the same as or similar to one or more registered event patterns; generating a notification upon identification of the occurrence of the event pattern. 2. The method of claim 1, wherein the one or more registered event patterns are specified by a user. 3. The method of claim 1, wherein the analyzing data in the subset of events uses scripts to analyze the event pattern. 4. The method of claim 1, wherein the analyzing data in the subset of events uses regular expressions to analyze the event pattern. 5. The method of claim 1, wherein the notification is an email message. 6. The method of claim 1, wherein the notification is a text message. 7. The method of claim 1, wherein the notification is an audio user-interface alarm. 8. The method of claim 1, wherein the notification is a visual user-interface alarm. 9. The method of claim 1, wherein the machine data includes log files. 10. The method of claim 1, wherein the subset of events are associated with one or more computational nodes among the plurality of computational nodes. 11. The method of claim 1, wherein the generating the plurality of time stamped events from the received machine data further comprises: parsing the received machine data to determine event boundaries within the received machine data. 12. The method of claim 1, wherein the event pattern comprises a pattern represented in a heat map, and wherein the heat map indicates a metric for each computational node of the plurality of computational nodes. 13. The method of claim 1, wherein the event pattern comprises a pattern represented in a heat map, wherein the heat map indicates a metric for each computational node of the plurality of computational nodes, and wherein analyzing data in a set of time stamped events further comprises determining whether the heat map is expanding or contracting by comparing the heat map to previous heat maps. 14. The method of claim 1, further comprising: upon identification of the occurrence of the event pattern, generating a visualization representing one or more computational nodes that generated events associated with the event pattern, the visualization also indicating a metric for the represented one or more computational nodes. 15. The method of claim 1, wherein the analysis to identify the occurrence of the event pattern is used to predict an occurrence of an abnormal condition. 16. The method of claim 1, wherein the analysis to identify the occurrence of the event pattern is used to predict that an error will occur. 17. The method of claim 1, wherein the analysis to identify the occurrence of an event pattern includes determining that the occurrence of the event pattern happened during a limited-duration time window associated with the registered event pattern. 18. The method of claim 1, wherein the analysis to identify the occurrence of an event pattern includes determining that the occurrence of the event pattern happened during a user selected time window associated with the registered event pattern. 19. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of: receiving machine data from a computing cluster, the computing cluster including a plurality of computational nodes; generating a plurality of time stamped events from the received machine data, each time stamped event having a time stamp derived from data parsed from the received machine data; analyzing data in a subset of events in the plurality of time stamped events using heuristic analysis to identify an occurrence of an event pattern that is the same as or similar to one or more registered event patterns; generating a notification upon identification of the occurrence of the event pattern. 20. The one or more non-transitory computer-readable storage media of claim 19, wherein the one or more registered event patterns are specified by a user. 21. The one or more non-transitory computer-readable storage media of claim 19, wherein the analysis to identify the occurrence of the event pattern is used to predict an occurrence of an abnormal condition. 22. The one or more non-transitory computer-readable storage media of claim 19, wherein the analysis to identify the occurrence of the event pattern is used to predict that an error will occur. 23. The one or more non-transitory computer-readable storage media of claim 19, wherein the analysis to identify the occurrence of an event pattern includes determining that the occurrence of the event pattern happened during a limited-duration time window associated with the registered event pattern. 24. The one or more non-transitory computer-readable storage media of claim 19, wherein the analysis to identify the occurrence of an event pattern includes determining that the occurrence of the event pattern happened during a user selected time window associated with the registered event pattern. 25. An apparatus comprising: a subsystem, implemented at least partially in hardware, that receives machine data from a computing cluster, the computing cluster including a plurality of computational nodes; a subsystem, implemented at least partially in hardware, that generates a plurality of time stamped events from the received machine data, each time stamped event having a time stamp derived from data parsed from the received machine data; a subsystem, implemented at least partially in hardware, that analyzes data in a subset of events in the plurality of time stamped events using heuristic analysis to identify an occurrence of an event pattern that is the same as or similar to one or more registered event patterns; a subsystem, implemented at least partially in hardware, that generates a notification upon identification of the occurrence of the event pattern. 26. The apparatus of claim 25, wherein the one or more registered event patterns are specified by a user. 27. The apparatus of claim 25, wherein the analysis to identify the occurrence of the event pattern is used to predict an occurrence of an abnormal condition. 28. The apparatus of claim 25, wherein the analysis to identify the occurrence of the event pattern is used to predict that an error will occur. 29. The apparatus of claim 25, wherein the analysis to identify the occurrence of an event pattern includes determining that the occurrence of the event pattern happened during a limited-duration time window associated with the registered event pattern. 30. The apparatus of claim 25, wherein the analysis to identify the occurrence of an event pattern includes determining that the occurrence of the event pattern happened during a user selected time window associated with the registered event pattern.