Systems and methods are disclosed for generating one or more journey instances from events having raw machine data associated with a timestamp. The system generates a user interface that includes field identifiers associated with the plurality events for selection as one or more pivot identifiers and one or more step identifiers. Based on the one or more pivot identifiers, the system identifies related events that share a common field value, and based on the one or more step identifiers, the system groups the related events into a subset of events. Using the subset of events the system builds a journey instance.