Maybe I'm missing something here, but at some point in my career the "entropy" command did something. Now when I try to use it I get this error:
index=files sourcetype=executables | entropy filename Unknown search command 'entropy'.
I'm clueless. Is/was the entropy command a thing?
I don't remember entropy as a natively available search command. There was a custom search command in one of the post (https://answers.splunk.com/answers/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-a...) that you might have used. Look at associate command as well (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Associate)
That was the command I had set up and posted the tutorial for. https://answers.splunk.com/answers/13636/calculate-entropy-just-entropy-not-change-in-entropy-like-a... Many people (including myself) started to use it in their environments so it might have become quite popular. I have even noticed it in place at sites I visit. I'll make an official App for it now that i see it is used more often. There's also more recently url toolbox which now has a ut_entropy command. But to keep this alive, I'll still make the entropy suite ready for posting on splunk apps.
Use the following code::
| stats count as sumfield by "field_name" | eventstats sum(sumfield) as Total | eval Entropy= -1(sumfield/Total)log(sumfield/Total)
| stats sum(Entropy) as entropyvalue by "*fieldname*"