https://community.splunk.com/t5/Reporting/datamodel-custom-command-as-calculated-field/m-p/440605#M7123 <P>We have built a considerable amount of logic using a combination of python and kvstore collections to categorise incoming data</P> <P>The custom command can be called after the root event by using </P> <PRE><CODE>| datamodel ... </CODE></PRE> <P>or</P> <PRE><CODE>| tstats ... values() </CODE></PRE> <P>but I'm not finding a way to call the custom command (a streaming version was also developed) as a calculated field in the datamodel so we can leverage its acceleration without a huge | tstats ... values() chain</P> <P>Any idea on how to do this ?</P> Thu, 07 Jun 2018 16:22:37 GMT splunk_zen 2018-06-07T16:22:37Z https://community.splunk.com/t5/Reporting/datamodel-custom-command-as-calculated-field/m-p/440605#M7123 <P>We have built a considerable amount of logic using a combination of python and kvstore collections to categorise incoming data</P> <P>The custom command can be called after the root event by using </P> <PRE><CODE>| datamodel ... </CODE></PRE> <P>or</P> <PRE><CODE>| tstats ... values() </CODE></PRE> <P>but I'm not finding a way to call the custom command (a streaming version was also developed) as a calculated field in the datamodel so we can leverage its acceleration without a huge | tstats ... values() chain</P> <P>Any idea on how to do this ?</P> Thu, 07 Jun 2018 16:22:37 GMT https://community.splunk.com/t5/Reporting/datamodel-custom-command-as-calculated-field/m-p/440605#M7123 splunk_zen 2018-06-07T16:22:37Z