Usage of the Funct command is relatively easy and works particularly well after a transforming command such as stats. Running the Funct commands requires that you specify the command (obviously), a source field, and output field. Optionally, you can specify a character limit. The default character limit is the first 1000 characters of a string.
Truly determine the number of different username formats that are floating around on your network. The following query will quickly show you policy vs. reality when it comes to username naming conventions.
| tstats count FROM datamodel=Authentication WHERE Authentication.user=* NOT Authentication.user=*$* by Authentication.user
| rename Authentication.* AS *
| funct user fieldname=funct_out
| stats latest(user) AS user by funct_out
On its way...
Submit an issue here https://github.com/jdeer0618/funct/issues
Updated README.md for app certification.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.