What happened to the entropy command?

[thisissplunk]

Maybe I'm missing something here, but at some point in my career the "entropy" command did something. Now when I try to use it I get this error:

index=files sourcetype=executables | entropy filename
Unknown search command 'entropy'.

I'm clueless. Is/was the entropy command a thing?

[Goku1]

Use the following code::
| stats count as sumfield by "field_name" | eventstats sum(sumfield) as Total | eval Entropy= -1*(sumfield/Total)log(sumfield/Total)
| stats sum(Entropy) as entropy_value by "*field_name"

[rshoward]

That was the command I had set up and posted the tutorial for. https://answers.splunk.com/answers/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-a... Many people (including myself) started to use it in their environments so it might have become quite popular. I have even noticed it in place at sites I visit. I'll make an official App for it now that i see it is used more often. There's also more recently url toolbox which now has a ut_entropy command. But to keep this alive, I'll still make the entropy suite ready for posting on splunk apps.

[somesoni2 · Accepted solution]

I don't remember entropy as a natively available search command. There was a custom search command in one of the post (https://answers.splunk.com/answers/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-a...) that you might have used. Look at associate command as well (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Associate)

[thisissplunk]

I have a feeling we had a custom command made from something like the above. Thanks!