Getting Data In

Props and transforms: Order of execution of transforms for multiple stanza?

koshyk
Super Champion

AS per props.conf documentation

  • Use a comma-separated list to apply multiple transform stanzas to a single

    TRANSFORMS extraction. Splunk applies them in the list order. For example,
    this sequence ensures that the [yellow] transform stanza gets applied
    first, then [blue], and then [red]:
    [source::color_logs]
    TRANSFORMS-colorchange = yellow, blue, red

But I have an issue whereby I cannot put all the 3 transforms in single stanza.

 [source::color_logs] # say this assigns a yellow_colored_logs  sourcetype
TRANSFORMS-colorchange = yellow
[yellow_colored_logs]
TRANSFORMS-zcolorchange = blue,red

Will the above order work? So basically my question is will splunk handle transforms on serial order if I put in multiple stanza?

Tags (2)
0 Karma

gcusello
Esteemed Legend

Hi koshyk,
I suggest to use one method to transform your logs (e.g. sourcetypes)

[yellow_colored_logs]
 TRANSFORMS-zcolorchange1 = blue,red
[red_colored_logs]
 TRANSFORMS-zcolorchange2 = blue,yellow
[blue_colored_logs]
 TRANSFORMS-zcolorchange3 = red,yellow

testing order.

Bye.
Giuseppe

koshyk
Super Champion

@cusello thanks for that. I will test and let you know. Meantime, I will upvote and if its successful I will mark as answer

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...