calldate,			clid,							src,			dst,			dcontext,			channel,						dstchannel,					lastapp,	lastdata
03/10/2016 15:58,	"XXXXXXXXXX" <XXXXXXXXXX>,		PSTN_CID,		EXTENSION,		crossservers,		PJSIP/<INBOUND PSTN>-0000aa62,	PJSIP/<EXTENSIN>-0000aa63,	Dial		PJSIP/<EXTENSION>
03/10/2016 15:58,	"EXTCALLER ID" <EXT CALLER ID>,	EXT CALLER ID	PSTN_DEST		from-internal,		PJSIP/<EXTENSION>-0000aa6c,		PJSIP/<PSTN>-0000aa6f		Dial		PJSIP/<PSTN>
03/10/2016 15:58,	"XXXXXXXXXX" <XXXXXXXXXX>,		PSTN_CID,		EXTENSION,		crossservers,		PJSIP/<INBOUND PSTN>-0000aa62,	PJSIP/<PSTN>-0000aa6f,		Dial		PJSIP/<EXTENSION>


The third line after the attended transfer should show:


03/10/2016 15:58,	"XXXXXXXXXX" <XXXXXXXXXX>,		PSTN_CID,		PSTN_DEST,		from-internal,		PJSIP/<INBOUND PSTN>-0000aa62,	PJSIP/<PSTN>-0000aa6f,		Dial		PJSIP/<PSTN>


The dst and dcontext should be updated to that of the second entry where the user made the call from their phone, taked to the far end and then transfered the call.