Methods and systems for determining event probabilities and anomalous events are provided. In one implementation, a method includes: receiving source data, where the source data is configured as a plurality of events with associated timestamps; searching the source data, where the searching provides a search result including N events from the plurality of events, where N is an integer greater than one, where each event of the N events includes a plurality of field values, where at least one event of the N events can include one or more categorical field values and one or more numerical field values; and for an event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities determined for the plurality of field values, determining a probability of occurrence for the event.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A computer-implemented method comprising: receiving source data, wherein the source data comprises raw data, further wherein the source data is configured as a plurality of events, each event of the plurality of events having an associated timestamp; using one or more extraction rules, searching the source data, the one or more extraction rules defining one or more fields, wherein the searching provides a search result comprising N events from the plurality of events, wherein N is an integer greater than one, wherein each event of the N events includes a plurality of field values, wherein at least one event of the N events can include one or more categorical field values and one or more numerical field values; and for an event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities determined for the plurality of field values, determining a probability of occurrence for the event. 2. The computer-implemented method of claim 1, wherein the determining the probability of occurrence for each field value of the plurality of field values comprises determining a probability of occurrence for at least one categorical field value and determining a probability of occurrence for at least one numerical field value, and further wherein the using the probabilities determined for the plurality of field values to determine the probability of occurrence for the event comprises using the probability of occurrence for the at least one categorical field value and the probability of occurrence for the at least one numerical field value. 3. The computer-implemented method of claim 1, wherein the searching comprises executing a search query, wherein the search query corresponds to a real-time search, wherein the executing comprises applying a late binding schema to the source data at search time, and wherein the one or more extraction rules are one or more extraction rules of the late binding schema. 4. The computer-implemented method of claim 1, wherein the source data comprises aggregated heterogeneous machine data generated by at least one of: a server, a database, an application, or a network. 5. The computer-implemented method of claim 1, wherein a probability of occurrence for a categorical field value is equal to O divided by N, wherein O is an integer that represents total number of times the categorical field value occurs in the N events. 6. The computer-implemented method of claim 1, wherein a probability of occurrence for a numerical field value is determined using histogram-based density estimation, wherein the probability of occurrence for the numerical field value is equal P divided by N, wherein P is equal to number of numerical field values in a bin containing the numerical field value, wherein width of the bin is equal to C divided by cube root of N, and wherein C is equal to 3.5 times standard deviation of field values for the numerical field value in the N events. 7. The computer-implemented method of claim 1, wherein the probability of occurrence for the a categorical field value is equal to O divided by N, wherein O is an integer that represents total number of times the categorical field value occurs in the N events, wherein the probability of occurrence for a numerical field value is determined using kernel density estimation, quantile estimation, or an empirical cumulative distribution function. 8. The computer-implemented method of claim 1, wherein the plurality of field values comprises Q NULL field values, wherein Q is an integer greater than or equal to 1, and further wherein a NULL field value for a field value in an event indicates that the field value does not have a value for the event. 9. The computer-implemented method of claim 1, wherein the plurality of field values comprises Q NULL field values, wherein Q is an integer greater than or equal to 1, wherein a NULL field value for a field value in an event indicates that the field value does not have a value for the event, wherein the Q NULL field values are categorical field values, wherein NULL field value is a field value category, and further wherein the probability for the NULL field value is equal to Q divided by N. 10. The computer-implemented method of claim 1, wherein the plurality of field values comprises Q NULL field values, wherein Q is an integer greater than or equal to 1, wherein a NULL field value for a field value in an event indicates that the field value does not have a value for the event, wherein the Q NULL field values are numerical field values, wherein a bin is designated for NULL field value, wherein there are Q NULL field values in the bin, and further wherein the probability for the NULL field value is equal to Q divided by N. 11. The computer-implemented method of claim 1, wherein determining the probability of occurrence for the event comprises determining a product of the probabilities of occurrence determined for the plurality of field values. 12. The computer-implemented method of claim 1, wherein determining the probability of occurrence for the event comprises (a) using a dense frequency table to compute a conditional probability, (b) (i) clustering events using a distance measure that combines categorical similarity and numeric distance, (ii) using cluster size divided by dataset size as a density estimate, and (iii) using the density estimate to compute the conditional probability, or (c) using a conditional probability table or a custom function to compute the conditional probability. 13. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event. 14. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for the N events, determining at least one outlier event. 15. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for the N events, determining at least one outlier event, wherein the determining the at least one outlier event comprises: determining a first quartile value, a second quartile value, and a third quartile value for event probabilities of occurrence of the N events, wherein a quarter of the event probabilities of occurrence are less than or equal to the first quartile value, wherein half of the event probabilities of occurrence are less than or equal to the second quartile value, and wherein three quarters of the event probabilities of occurrence are less than or equal to the third quartile value; determining an interquartile range, wherein the interquartile range is equal to the third quartile value minus the first quartile value; determining an anomalous event threshold, wherein the anomalous event threshold is equal to the first quartile value minus k times the interquartile range, wherein k is a positive number parameter; and designating as an anomalous event each event with a probability less than the anomalous event threshold. 16. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for the N events, determining at least one outlier event, wherein determining the at least one outlier event comprises using histogram-based density estimation, kernel density estimation, quantile estimation, an empirical cumulative distribution function, or a Z test. 17. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; for the N events, determining at least one outlier event; causing a user interface (UI) to display the probability of occurrence for each event of the N events; and causing the UI to indicate that the at least one outlier event is an outlier event. 18. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for the N events, determining at least one outlier event, wherein determining the at least one outlier event is done in response to receiving an anomalous event determination command. 19. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; for the N events, determining at least one outlier event; and providing an alert that at least one outlier event has been found. 20. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; for the N events, determining at least one outlier event; and for each event of the N events, adding a field indicating whether the event is an anomalous event. 21. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; for the N events, determining at least one outlier event; for each event of the N events, adding a field indicating whether the event is an anomalous event; and filtering out events that are not anomalous. 22. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for each event of the N events, adding a field indicating the probability of occurrence for the event. 23. The computer-implemented method of claim 1 further comprising: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; computing statistical values for the probabilities of occurrence for the events; and causing a user interface to display at least some of the statistical values. 24. The computer-implemented method of claim 1, wherein the one or more extraction rules are regular expression rules (regex rules). 25. The computer-implemented method of claim 1 further comprising: storing the plurality of events in a data source. 26. The computer-implemented method of claim 1, wherein the raw data comprises log data, application data, or packet data. 27. One or more non-transitory computer-readable media storing instructions that, when executed by one or more computing devices, cause performance of: receiving source data, wherein the source data comprises raw data, further wherein the source data is configured as a plurality of events, each event of the plurality of events having an associated timestamp; using one or more extraction rules, searching the source data, the one or more extraction rules defining one or more fields, wherein the searching provides a search result comprising N events from the plurality of events, wherein N is an integer greater than one, wherein each event of the N events includes a plurality of field values, wherein at least one event of the N events can include one or more categorical field values and one or more numerical field values; and for an event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities determined for the plurality of field values, determining a probability of occurrence for the event. 28. The one or more non-transitory computer-readable media of claim 27, wherein the instructions cause performance of: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for the N events, determining at least one outlier event. 29. A system comprising: one or non-transitory computer-readable media storing instructions; and one or more computing devices configured to execute the instructions to cause: receiving source data, wherein the source data comprises raw data, further wherein the source data is configured as a plurality of events, each event of the plurality of events having an associated timestamp; using one or more extraction rules, searching the source data, the one or more extraction rules defining one or more fields, wherein the searching provides a search result comprising N events from the plurality of events, wherein N is an integer greater than one, wherein each event of the N events includes a plurality of field values, wherein at least one event of the N events can include one or more categorical field values and one or more numerical field values; and for an event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities determined for the plurality of field values, determining a probability of occurrence for the event. 30. The system of claim 29, wherein the instructions cause: for each event of the N events, determining a probability of occurrence for each field value of the plurality of field values; and using probabilities of occurrence determined for the plurality of field values, determining a probability of occurrence for the each event; and for the N events, determining at least one outlier event.