You have to look at the names of the transforms and how they're laid out. But it's a simple set of rules.
Consider
REPORT-aaa = extract_src2, extract_src1
REPORT-bbb = extract_src3
If those all apply to the same events, then...
REPORT-aaa applies two transforms, in the order they're written. extract_src2 will happen before extract_src1. If they both extract a field called 'src', then the last one extracted is the final value after that's been run.
THEN REPORT-bbb gets run. Again, if it extracts a field called src (and actually extracts it because it matches, etc...) then it extracts src, overwriting whatever is there.
So, last to run overwrites all that came before it, assuming it actually extracts.
(That last is actually important. You can try to extract field1 from a certain regex. Then you can try to re-extract it from a different regex. If the second regex doesn't match the event, then it's not re-extracted, and it won't overwrite. This is one of the ways to pile up a whole lot of different ways to extract a certain field.)
This is dense, but has all the answers:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence
And while ultimately it's linked from in that page above, here's the detailed look at the lexicographical ordering:
https://docs.splunk.com/Documentation/Splunk/8.0.5/Knowledge/Searchtimeoperationssequence#Lexicograp...
