1. A method comprising: receiving, by a processing device, a query comprising a first field value and a time period; performing, by the processing device, a first search of a data store using the first field value to identify a first plurality of events having the time period and at least one field that comprises the first field value; determining one or more additional searches to perform automatically based on the first plurality of events returned by the first search, wherein determining a second search to perform based on a first event of the plurality of events comprises: determining a first context definition associated with the first event, wherein the first context definition identifies a specified plurality of fields to use as link keys, each of the specified plurality of fields having assigned field types; and determining a second field value of a second field in the first event, wherein the second field is one of the plurality of fields in the first context definition that is specified to use as a link key; automatically performing, by the processing device without receipt of a second query, the second search of the data store using the second field value that was not included in the query to identify a second plurality of events having the time period and the second field value; aggregating information from the first plurality of events and the second plurality of events; and generating a response to the query that comprises the information aggregated from the first plurality of events and the second plurality of events.