Reporting

datamodel - custom command as calculated field

splunk_zen
Builder

We have built a considerable amount of logic using a combination of python and kvstore collections to categorise incoming data

The custom command can be called after the root event by using

| datamodel ... 

or

| tstats ... values()

but I'm not finding a way to call the custom command (a streaming version was also developed) as a calculated field in the datamodel so we can leverage its acceleration without a huge | tstats ... values() chain

Any idea on how to do this ?

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...