1. A method comprising: receiving, by a processing device, a query comprising a first field value and a time period; performing, by the processing device, a first search of a data store using the first field value to identify a first plurality of events having the time period and at least one field that comprises the first field value; determining, for a first event of the plurality of events, a second field value of a second field that is specified in a first context definition, the second field having an assigned field type; performing, by the processing device without receipt of a second query, a second search of the data store using the additional field value to identify a second plurality of events having the time period and the additional field value; aggregating information from the first plurality of events and the second plurality of events; and generating a response to the query that comprises the information aggregated from the first plurality of events and the second plurality of events.