What is the precedence for "SEDCMD" attribute?

[Hajime]

I think the precedence for "SEDCMD" attribute within single stanza is ASCII order.

For example props.conf:

[foo]
SEDCMD-01 = s/foo/bar/g
SEDCMD-02 = s/bar/foo/g

In this case, SEDCMD-01 is done firstly and then SEDCMD-02 is done.

Is this correct?

Please let me know that.

[somesoni2 · Accepted solution]

Yes, the SEDCMD is applied in the alphabetical order of the class.

SEDCMD-01 is executed before SEDCMD-02
SEDCMD-abc02 is executed before SEDCMD-def01
SEDCMD-AAA02 is executed before SEDCMD-abc02

[Hajime]

Thank you for your answer.
I agree with you.
Also I wish to be written this description to the manuals.

[somesoni2]

The topic about SEDCMD is available here. You can leave a comment at the bottom of the page and Splunk doc team help get this added.

http://docs.splunk.com/Documentation/Splunk/6.3.3/Data/Anonymizedata

[Hajime]

Thank you for your kind advice!