We have built a considerable amount of logic using a combination of python and kvstore collections to categorise incoming data
The custom command can be called after the root event by using
| datamodel ...
or
| tstats ... values()
but I'm not finding a way to call the custom command (a streaming version was also developed) as a calculated field in the datamodel so we can leverage its acceleration without a huge | tstats ... values() chain
Any idea on how to do this ?
