Getting Data In

What is the order of execution / precedence of multiple TRANSFORMS in this example?

dannestor
Explorer

Consider

[source::single]
TRANSFORMS-single = transform1, transform2

[source::double]
TRANSFORMS-first = transform1
TRANSFORMS-second = transform2

What's the difference between the two? Specifically, for each of the two sources:
1. What is the order of execution for transforms 1 and 2?
2. Does the execution stop early (i.e. if transform1 matches, transform2 is not evaluated)?

0 Karma
1 Solution

woodcock
Esteemed Legend

The information is here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf

The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority configuration to alter the default, it is top-to-bottom.

The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.

View solution in original post

woodcock
Esteemed Legend

The information is here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf

The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority configuration to alter the default, it is top-to-bottom.

The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.

View solution in original post

dvb
Path Finder

As I understand
* priority only works for whole stanzas, not single entries
* having multiple TRANSFORMS for one stanza, they are executed in alphabetical order

0 Karma

dajomas
Path Finder

Actually, Splunk applies all transforms in turn, left to right, and it DOES overwrite the set values. So keep this in mind when ordering the transforms!

0 Karma

nikhiltyagi
Explorer

Not able to find where is below documented:
"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones will not update/overwrite that original value."

0 Karma

anwarmian
Communicator

It should read as woodcock mentioned.

"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones CAN update/overwrite that original value."  

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!