topic Re: What's the difference between these two transforms stanzas in props.conf? in Getting Data In

What's the difference between these two transforms stanzas in props.conf?

ankithreddy777 — Thu, 01 Jun 2023 20:59:54 GMT

May I know the difference between writing transforms stanza in props.conf in different ways

Ex:

transforms-xyz = transforms1, transforms2

[in this case to my knowledge transforms1 executed first and the remaining events go to transforms2]

AND

transforms-xyz=transforms1
tranforms-abc=transforms2

Re: What's the difference between these two transforms stanzas in props.conf?

jkat54 — Wed, 30 Aug 2017 17:56:53 GMT

TRANSFORMS-<class> = <transform_stanza_name>, <transform_stanza_name2>,...
...
* Use a comma-separated list to apply multiple transform stanzas to a single
  TRANSFORMS extraction. Splunk applies them in the list order. For example,
  this sequence ensures that the [yellow] transform stanza gets applied
  first, then [blue], and then [red]:
        [source::color_logs]
        TRANSFORMS-colorchange = yellow, blue, red

Otherwise it is ASCII order by the classname as in uppercase A comes before uppercase Z and lowercase a comes after uppercase Z. It's handy to reference an ASCII table for this:

https://duckduckgo.com/?q=ascii+table&atb=v38-2&ia=answer&iax=1

the lower the decimal value of the ASCII character, the higher priority the class will have in Splunk.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles#How_Splunk_determines_precedence_order

Re: What's the difference between these two transforms stanzas in props.conf?

jkat54 — Wed, 30 Aug 2017 18:00:03 GMT

So in a way it's probably better practice using the comma separation. I have a habit of doing it like this though:

TRANSFORMS-aaa=
TRANSFORMS-bbb=
...
TRANSFORMS-zzz=

This way someone else can come behind me and decide they need to transform before all my rules with

TRANSFORMS-AAA

Or after my rules with more z's

TRANSFORMS-zzzz

Re: What's the difference between these two transforms stanzas in props.conf?

woodcock — Thu, 31 Aug 2017 14:20:43 GMT

I always use CSV; it clearly shows the order and changing the order or inserting in the middle is trivial.