This does what you say you want: | eventstats values(eval(if(sourceImageName="baseline",newImageName,null()))) as derived
| eval sourceImageName=if(in(sourceImageName, derived),"baseline",sourceImageName)
| eval sourceImageName=if(sourceImageName!="baseline","unknown","baseline") However, is it really what you want as image5 is derived from image 3, which is derived from baseline. If you want to know which images are ultimately derived from baseline, you need to repeat the first two lines (for as many depths as you need). | eventstats values(eval(if(sourceImageName="baseline",newImageName,null()))) as derived
| eval sourceImageName=if(in(sourceImageName, derived),"baseline",sourceImageName)
| eventstats values(eval(if(sourceImageName="baseline",newImageName,null()))) as derived
| eval sourceImageName=if(in(sourceImageName, derived),"baseline",sourceImageName)
| eventstats values(eval(if(sourceImageName="baseline",newImageName,null()))) as derived
| eval sourceImageName=if(in(sourceImageName, derived),"baseline",sourceImageName)
| eval sourceImageName=if(sourceImageName!="baseline","unknown","baseline")
... View more