What is the order of execution / precedence of multiple TRANSFORMS in this example?

[dannestor]

Consider

[source::single]
TRANSFORMS-single = transform1, transform2

[source::double]
TRANSFORMS-first = transform1
TRANSFORMS-second = transform2

What's the difference between the two? Specifically, for each of the two sources:
1. What is the order of execution for transforms 1 and 2?
2. Does the execution stop early (i.e. if transform1 matches, transform2 is not evaluated)?

[woodcock · Accepted solution]

The information is here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf

The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority configuration to alter the default, it is top-to-bottom.

The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.

[dvb]

As I understand
* priority only works for whole stanzas, not single entries
* having multiple TRANSFORMS for one stanza, they are executed in alphabetical order

[dajomas]

Actually, Splunk applies all transforms in turn, left to right, and it DOES overwrite the set values. So keep this in mind when ordering the transforms!

[nikhiltyagi]

Not able to find where is below documented:
"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones will not update/overwrite that original value."

[anwarmian]

It should read as woodcock mentioned.

"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones CAN update/overwrite that original value."