I think the precedence for "SEDCMD" attribute within single stanza is ASCII order.
For example props.conf:
SEDCMD-01 = s/foo/bar/g
SEDCMD-02 = s/bar/foo/g
In this case, SEDCMD-01 is done firstly and then SEDCMD-02 is done.
Is this correct?
Please let me know that.
Yes, the SEDCMD is applied in the alphabetical order of the class.
SEDCMD-01 is executed before SEDCMD-02
SEDCMD-abc02 is executed before SEDCMD-def01
SEDCMD-AAA02 is executed before SEDCMD-abc02
View solution in original post
Thank you for your answer.
I agree with you.
Also I wish to be written this description to the manuals.
The topic about SEDCMD is available here. You can leave a comment at the bottom of the page and Splunk doc team help get this added.
Thank you for your kind advice!