datamodel - custom command as calculated field

Reporting

We have built a considerable amount of logic using a combination of python and kvstore collections to categorise incoming data

The custom command can be called after the root event by using

| datamodel ...

| tstats ... values()

but I'm not finding a way to call the custom command (a streaming version was also developed) as a calculated field in the datamodel so we can leverage its acceleration without a huge | tstats ... values() chain

Any idea on how to do this ?

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...