Getting Data In

What's the difference between these two transforms stanzas in props.conf?

ankithreddy777
Contributor

May I know the difference between writing transforms stanza in props.conf in different ways

Ex:

transforms-xyz = transforms1, transforms2

[in this case to my knowledge transforms1 executed first and the remaining events go to transforms2]

AND

transforms-xyz=transforms1
tranforms-abc=transforms2

0 Karma

jkat54
SplunkTrust
SplunkTrust
TRANSFORMS-<class> = <transform_stanza_name>, <transform_stanza_name2>,...
...
* Use a comma-separated list to apply multiple transform stanzas to a single
  TRANSFORMS extraction. Splunk applies them in the list order. For example,
  this sequence ensures that the [yellow] transform stanza gets applied
  first, then [blue], and then [red]:
        [source::color_logs]
        TRANSFORMS-colorchange = yellow, blue, red

Otherwise it is ASCII order by the classname as in uppercase A comes before uppercase Z and lowercase a comes after uppercase Z. It's handy to reference an ASCII table for this:

https://duckduckgo.com/?q=ascii+table&atb=v38-2&ia=answer&iax=1

the lower the decimal value of the ASCII character, the higher priority the class will have in Splunk.

http://docs.splunk.com/Documentation/Splunk/6.6.3/Admin/Wheretofindtheconfigurationfiles#How_Splunk_...

jkat54
SplunkTrust
SplunkTrust

So in a way it's probably better practice using the comma separation. I have a habit of doing it like this though:

TRANSFORMS-aaa=
TRANSFORMS-bbb=
...
TRANSFORMS-zzz=

This way someone else can come behind me and decide they need to transform before all my rules with

TRANSFORMS-AAA

Or after my rules with more z's

TRANSFORMS-zzzz

0 Karma

woodcock
Esteemed Legend

I always use CSV; it clearly shows the order and changing the order or inserting in the middle is trivial.

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...