- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Consider
[source::single]
TRANSFORMS-single = transform1, transform2
[source::double]
TRANSFORMS-first = transform1
TRANSFORMS-second = transform2
What's the difference between the two? Specifically, for each of the two sources:
1. What is the order of execution for transforms 1 and 2?
2. Does the execution stop early (i.e. if transform1 matches, transform2 is not evaluated)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The information is here:
http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf
The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority
configuration to alter the default, it is top-to-bottom.
The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The information is here:
http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf
The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority
configuration to alter the default, it is top-to-bottom.
The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I understand
* priority only works for whole stanzas, not single entries
* having multiple TRANSFORMS for one stanza, they are executed in alphabetical order
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Actually, Splunk applies all transforms in turn, left to right, and it DOES overwrite the set values. So keep this in mind when ordering the transforms!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not able to find where is below documented:
"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones will not update/overwrite that original value."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It should read as woodcock mentioned.
"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones CAN update/overwrite that original value."
