We wonder what is better for this query -
index=_audit action=alert_fired ss_app=<app name> | stats count as TotalEvents max(triggered_alerts) as TotalFires max(_time) as MostRecent by ss_name severity alert_actions | convert ctime(MostRecent) | sort - TotalFires
| convert ctime(MostRecent) or
| eval formatted_time=strftime(MostRecent, "%H:%M:%S %d-%m-%Y") ?
They largely offer the same functionality for this use case - converting an epoch timestamp into a timestamp format of your choosing. You can rename with either (an
AS clause in the
convert call or with a new variable in
eval) or override the initial variable value. Both offer the ability to specify a timeformat as well (one with the
timeformat argument and the other as part of the
Where they differ is in additional functionality outside of this specific use case. An
eval function can do more than just this in one line - you could nest additional calls around
strftime if you wanted, like zipping the timestamp to another value or wrapping it in an if clause, etc. Alternatively,
convert can do a lot out of the box (take a look at the functions here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Convert#Syntax).
As far as this use case goes, if you can get both of them to return the time format you want, I'd inspect the job and see which runs faster. I imagine it will be negligible, but you might find one to be slightly more performant than the other. I personally prefer
convert out of the box because I can write it quicker than an
strftime clause 🙂
Hope this helps!