I think the precedence for "SEDCMD" attribute within single stanza is ASCII order.
For example props.conf:
[foo] SEDCMD-01 = s/foo/bar/g SEDCMD-02 = s/bar/foo/g
In this case, SEDCMD-01 is done firstly and then SEDCMD-02 is done.
Is this correct?
Please let me know that.
Yes, the SEDCMD is applied in the alphabetical order of the class.
SEDCMD-01 is executed before SEDCMD-02 SEDCMD-abc02 is executed before SEDCMD-def01 SEDCMD-AAA02 is executed before SEDCMD-abc02
The topic about SEDCMD is available here. You can leave a comment at the bottom of the page and Splunk doc team help get this added.