https://community.splunk.com/t5/Splunk-Search/Do-I-have-to-explicitly-define-each-field-that-can-be-used-by-an/m-p/229082#M67836 <P>Since it doesn't look like you can get around this, I ended up making a custom command instead: <A href="https://answers.splunk.com/answers/398976/can-someone-give-me-an-incredibly-simple-custom-st.html">https://answers.splunk.com/answers/398976/can-someone-give-me-an-incredibly-simple-custom-st.html</A></P> Tue, 03 May 2016 22:59:38 GMT thisissplunk 2016-05-03T22:59:38Z https://community.splunk.com/t5/Splunk-Search/Do-I-have-to-explicitly-define-each-field-that-can-be-used-by-an/m-p/229081#M67835 <P>I've made an external lookup python script that calculates the entropy of a field's value using the first block of code from this answer: <A href="https://answers.splunk.com/answers/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-associate.html">https://answers.splunk.com/answers/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-associate.html</A></P> <P>That works. Now I'm implementing it in transforms as seen here: <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/Configureexternallookups">http://docs.splunk.com/Documentation/Splunk/6.3.1/Knowledge/Configureexternallookups</A><BR /> Or more specifically:</P> <PRE><CODE>[&lt;lookup_name&gt;]: The name of the lookup. external_cmd = &lt;string&gt;: The command and arguments that the Splunk platform should invoke to perform the lookup. The Splunk platform expects the command to be the name of the script, such as external_lookup.py. external_type = [python|executable|kvstore|geo]: The type of script being used for the lookup. Can be python, for a Python script, or executable, for a binary executable. The kvstore and geo values are reserved for KV store lookups and geospatial lookups, respectively. fields_list = &lt;string&gt;: is a list of all fields that are supported by the external lookup. The fields must be delimited by a comma followed by a space. </CODE></PRE> <P><STRONG>Question:</STRONG><BR /> See <EM>fields_list</EM> above. I <STRONG>don't</STRONG> want to limit this lookup to any fields right now (this will <STRONG>not</STRONG> be an automatic lookup). Can I simply not add that line so that the external lookup command will work on any field I send to it?</P> Mon, 02 May 2016 19:42:23 GMT https://community.splunk.com/t5/Splunk-Search/Do-I-have-to-explicitly-define-each-field-that-can-be-used-by-an/m-p/229081#M67835 thisissplunk 2016-05-02T19:42:23Z https://community.splunk.com/t5/Splunk-Search/Do-I-have-to-explicitly-define-each-field-that-can-be-used-by-an/m-p/229082#M67836 <P>Since it doesn't look like you can get around this, I ended up making a custom command instead: <A href="https://answers.splunk.com/answers/398976/can-someone-give-me-an-incredibly-simple-custom-st.html">https://answers.splunk.com/answers/398976/can-someone-give-me-an-incredibly-simple-custom-st.html</A></P> Tue, 03 May 2016 22:59:38 GMT https://community.splunk.com/t5/Splunk-Search/Do-I-have-to-explicitly-define-each-field-that-can-be-used-by-an/m-p/229082#M67836 thisissplunk 2016-05-03T22:59:38Z