topic Re: What is the order of execution / precedence of multiple TRANSFORMS in this example? in Getting Data In

What is the order of execution / precedence of multiple TRANSFORMS in this example?

dannestor — Thu, 22 Oct 2015 07:17:48 GMT

Consider

[source::single]
TRANSFORMS-single = transform1, transform2

[source::double]
TRANSFORMS-first = transform1
TRANSFORMS-second = transform2

What's the difference between the two? Specifically, for each of the two sources:
1. What is the order of execution for transforms 1 and 2?
2. Does the execution stop early (i.e. if transform1 matches, transform2 is not evaluated)?

Re: What is the order of execution / precedence of multiple TRANSFORMS in this example?

woodcock — Thu, 22 Oct 2015 13:23:42 GMT

The information is here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf

The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority configuration to alter the default, it is top-to-bottom.

The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.

Re: What is the order of execution / precedence of multiple TRANSFORMS in this example?

nikhiltyagi — Wed, 29 Nov 2017 06:03:13 GMT

Not able to find where is below documented:
"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones will not update/overwrite that original value."

Re: What is the order of execution / precedence of multiple TRANSFORMS in this example?

dajomas — Wed, 10 Jan 2018 13:25:59 GMT

Actually, Splunk applies all transforms in turn, left to right, and it DOES overwrite the set values. So keep this in mind when ordering the transforms!

Re: What is the order of execution / precedence of multiple TRANSFORMS in this example?

dvb — Thu, 18 Apr 2019 11:49:47 GMT

As I understand
* priority only works for whole stanzas, not single entries
* having multiple TRANSFORMS for one stanza, they are executed in alphabetical order

Re: What is the order of execution / precedence of multiple TRANSFORMS in this example?

anwarmian — Tue, 27 Oct 2020 02:59:32 GMT

It should read as woodcock mentioned.

"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones CAN update/overwrite that original value."