Implementing Splunk 7, Third Edition - Third Edition

Chaining transforms

As covered before in the Attributes with class section, transforms are executed in a particular order. In most cases, this order does not matter, but there are occasions when you might want to chain transforms together, with one transform relying on a field created by a previous transform.

A good example is the source flattening that we used previously, in the Overriding source section. If this transform happened before our transform in the Creating a session field from source section, our session field will always have the value x.

Let's reuse two transforms from previous sections and then create one more transform. We will chain them to pull the first part of session into yet another field. Say we have these transforms: ...