I have a global synced table which I update on threshold_crossed in SumStats.
The update is successful, yet when I try to access this table from a different event (dns query reply) it is empty.
I work wih bro 2.4.1 in cluster mode. The table is defined as global, synced and mergable.
My goal is that all workers will send their observations to SumStats and based on a threshold, update a table for all the workers to know.
Any ideas what can I try ?