topic Re: convert mktime() Vs eval strptime() Which is faster and better in Splunk Search

convert mktime() Vs eval strptime() Which is faster and better

strive — Sun, 14 Jul 2013 12:03:24 GMT

Hi,

We can use convert mktime() or eval strptime() to convert time into epoch time format. I am more interested in knowing which is better and faster.

Consider a scenario where 50GB or 100GB of log events are indexed per day. In this case which one do you recommend.

Thanks

Strive

Re: convert mktime() Vs eval strptime() Which is faster and better

sowings — Sun, 14 Jul 2013 12:43:33 GMT

Are you talking about expressing the _time field in epoch format? Or did you mean some other field?

Re: convert mktime() Vs eval strptime() Which is faster and better

strive — Sun, 14 Jul 2013 13:12:25 GMT

Yes expressing _time field in epoch format. Also we have some time fields in logs. Session start time, session end time etc...

Re: convert mktime() Vs eval strptime() Which is faster and better

strive — Mon, 15 Jul 2013 06:20:51 GMT

I tested both with log volume of 4.2 million records. I did not see much difference.. convert was faster by fraction of seconds.

Re: convert mktime() Vs eval strptime() Which is faster and better

Drainy — Mon, 15 Jul 2013 07:40:18 GMT

It looks like you've come to your answer. I don't think there is really much difference and in fact I suspect they probably use pretty much the same libraries on the backend, just exposed slightly differently.

Just an aside, which sowings seemed to be moving to. _time is already in epoch, there is some magical javascript that just recognises when _time is on screen and changes it to a readable format, try doing a rename on _time and using the new name in a table, it will suddenly be an epoch!

Re: convert mktime() Vs eval strptime() Which is faster and better

RMartinezDTV — Thu, 26 Jan 2017 20:09:18 GMT

The answer lies in the difference between convert and eval, rather than between mktime() and strptime(). Eval-based commands irrevocably alter the field's data while convert is more of a "visual gloss" in that the field retains the original data and only the view/UI shows the converted value.

In most cases, this won't matter but might be important to consider if you're running jobs, reports, etc. in some method besides a human looking at a screen.

Re: convert mktime() Vs eval strptime() Which is faster and better

somesoni2 — Thu, 26 Jan 2017 20:18:33 GMT

I think you're explaining difference between eval and fieldformat command. The convert command updates the original field value (or creates a new if AS clause is used), not just the UI show like fieldformat.

You're correct about the answer lies int eh difference between convert and eval. You can update only one field at a time in eval whereas in convert you can update multiple fields and/or use wildcard in the field names. I don't think there is much different in speed between mktime and strptime.