Getting Data In

Props and transforms: Order of execution of transforms for multiple stanza?

koshyk
Super Champion

AS per props.conf documentation

  • Use a comma-separated list to apply multiple transform stanzas to a single

    TRANSFORMS extraction. Splunk applies them in the list order. For example,
    this sequence ensures that the [yellow] transform stanza gets applied
    first, then [blue], and then [red]:
    [source::color_logs]
    TRANSFORMS-colorchange = yellow, blue, red

But I have an issue whereby I cannot put all the 3 transforms in single stanza.

 [source::color_logs] # say this assigns a yellow_colored_logs  sourcetype
TRANSFORMS-colorchange = yellow
[yellow_colored_logs]
TRANSFORMS-zcolorchange = blue,red

Will the above order work? So basically my question is will splunk handle transforms on serial order if I put in multiple stanza?

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi koshyk,
I suggest to use one method to transform your logs (e.g. sourcetypes)

[yellow_colored_logs]
 TRANSFORMS-zcolorchange1 = blue,red
[red_colored_logs]
 TRANSFORMS-zcolorchange2 = blue,yellow
[blue_colored_logs]
 TRANSFORMS-zcolorchange3 = red,yellow

testing order.

Bye.
Giuseppe

koshyk
Super Champion

@cusello thanks for that. I will test and let you know. Meantime, I will upvote and if its successful I will mark as answer

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...