topic Re: What is the precedence for "SEDCMD" attribute? in Getting Data In

What is the precedence for "SEDCMD" attribute?

Hajime — Tue, 23 Feb 2016 02:09:44 GMT

I think the precedence for "SEDCMD" attribute within single stanza is ASCII order.

For example props.conf:

[foo]
SEDCMD-01 = s/foo/bar/g
SEDCMD-02 = s/bar/foo/g

In this case, SEDCMD-01 is done firstly and then SEDCMD-02 is done.

Is this correct?

Please let me know that.

somesoni2 — Tue, 23 Feb 2016 03:28:37 GMT

Yes, the SEDCMD is applied in the alphabetical order of the class.

SEDCMD-01 is executed before SEDCMD-02
SEDCMD-abc02 is executed before SEDCMD-def01
SEDCMD-AAA02 is executed before SEDCMD-abc02

Hajime — Wed, 24 Feb 2016 01:12:11 GMT

Thank you for your answer.
I agree with you.
Also I wish to be written this description to the manuals.

somesoni2 — Wed, 24 Feb 2016 01:48:15 GMT

The topic about SEDCMD is available here. You can leave a comment at the bottom of the page and Splunk doc team help get this added.

Hajime — Wed, 24 Feb 2016 05:35:29 GMT

Thank you for your kind advice!