Suppose that there is a log with two fields, userName and phoneNumber, the structure is like: userName | phoneNumber A | 0111 A | 0222 | 0111 B | 0333 | 0222 | 0333 Namely, one phone number must and only belongs to one user. In some events, both two fields would appear but in other events, only phoneNumber field exists. My question is, how to correlate each phone number with a particular user name, so that I can understand who has the number without depending on user name fields? I expect the new fields would like this: userName | phoneNumber A | A, 0111 A | A, 0222 | A, 0111 B | B, 0333 | A, 0222 | B, 0333 It's quite easy if both fields exist in one event: | eval phoneNumber = UserID. "-" .phoneNumber | But how to make this change work for events without userName field? ... View more