Getting Data In

What is the order of execution / precedence of multiple TRANSFORMS in this example?

dannestor
Explorer

Consider

[source::single]
TRANSFORMS-single = transform1, transform2

[source::double]
TRANSFORMS-first = transform1
TRANSFORMS-second = transform2

What's the difference between the two? Specifically, for each of the two sources:
1. What is the order of execution for transforms 1 and 2?
2. Does the execution stop early (i.e. if transform1 matches, transform2 is not evaluated)?

0 Karma
1 Solution

woodcock
Esteemed Legend

The information is here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf

The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority configuration to alter the default, it is top-to-bottom.

The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.

View solution in original post

woodcock
Esteemed Legend

The information is here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/admin/propsconf

The answer is that in the former/single example, the order is left-to-right; in the latter/double example, since you are not using the priority configuration to alter the default, it is top-to-bottom.

The execution does not "stop early" and fields are usually overridden (although I am not sure this has always been the case for all versions) so once an earlier-executed transform has given a field a value, later-executed ones can update/overwrite that original value.

dvb
Path Finder

As I understand
* priority only works for whole stanzas, not single entries
* having multiple TRANSFORMS for one stanza, they are executed in alphabetical order

0 Karma

dajomas
Path Finder

Actually, Splunk applies all transforms in turn, left to right, and it DOES overwrite the set values. So keep this in mind when ordering the transforms!

0 Karma

nikhiltyagi
Explorer

Not able to find where is below documented:
"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones will not update/overwrite that original value."

0 Karma

anwarmian
Communicator

It should read as woodcock mentioned.

"Although the execution does not "stop early" fields are not overridden so once an earlier-executed transform has given a field a value, later-executed ones CAN update/overwrite that original value."  

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...