Correct, they both take place in the same phase. Not sure how it exactly works under the hood, but basically when the event enters the phase, splunk looks at host, source and sourcetype and based on that determines what props and transforms to apply during typing phase and then applies all those in a certain order. Those props and transforms may change host, source and sourcetype, but this does not trigger Splunk to re-evaluate what props and transforms to apply.
Changing those 3 fields is basically only useful for search time.
The only exception is when you do a CLONE_SOURCETYPE transform, there the cloned events are injected back in to the start of the pipeline and SED etc. is applied as if it had come in originally with the new sourcetype. But I guess you're not interested in cloning anything.
... View more