May I know the difference between writing transforms stanza in props.conf in different ways
Ex:
transforms-xyz = transforms1, transforms2
[in this case to my knowledge transforms1 executed first and the remaining events go to transforms2]
AND
transforms-xyz=transforms1
tranforms-abc=transforms2
TRANSFORMS-<class> = <transform_stanza_name>, <transform_stanza_name2>,...
...
* Use a comma-separated list to apply multiple transform stanzas to a single
TRANSFORMS extraction. Splunk applies them in the list order. For example,
this sequence ensures that the [yellow] transform stanza gets applied
first, then [blue], and then [red]:
[source::color_logs]
TRANSFORMS-colorchange = yellow, blue, red
Otherwise it is ASCII order by the classname as in uppercase A comes before uppercase Z and lowercase a comes after uppercase Z. It's handy to reference an ASCII table for this:
https://duckduckgo.com/?q=ascii+table&atb=v38-2&ia=answer&iax=1
the lower the decimal value of the ASCII character, the higher priority the class will have in Splunk.
So in a way it's probably better practice using the comma separation. I have a habit of doing it like this though:
TRANSFORMS-aaa=
TRANSFORMS-bbb=
...
TRANSFORMS-zzz=
This way someone else can come behind me and decide they need to transform before all my rules with
TRANSFORMS-AAA
Or after my rules with more z's
TRANSFORMS-zzzz
I always use CSV; it clearly shows the order and changing the order or inserting in the middle is trivial.