Use the following code:: | stats count as sumfield by "field_name" | eventstats sum(sumfield) as Total | eval Entropy= -1*(sumfield/Total)log(sumfield/Total) | stats sum(Entropy) as entropy_value by "*field_name" ... View more