Splunk Search

What is better for the conversion, eval or convert?

danielbb
Motivator

We wonder what is better for this query -

index=_audit action=alert_fired ss_app=<app name> 
| stats count as TotalEvents max(triggered_alerts) as TotalFires max(_time) as MostRecent by ss_name severity alert_actions 
| convert ctime(MostRecent) 
| sort - TotalFires

| convert ctime(MostRecent) or | eval formatted_time=strftime(MostRecent, "%H:%M:%S %d-%m-%Y") ?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Actually, neither. In the vast majority of cases, you should be using fieldformat:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat

View solution in original post

woodcock
Esteemed Legend

Actually, neither. In the vast majority of cases, you should be using fieldformat:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat

aberkow
Builder

They largely offer the same functionality for this use case - converting an epoch timestamp into a timestamp format of your choosing. You can rename with either (an AS clause in the convert call or with a new variable in eval) or override the initial variable value. Both offer the ability to specify a timeformat as well (one with the timeformat argument and the other as part of the strftimefunction).

Where they differ is in additional functionality outside of this specific use case. An eval function can do more than just this in one line - you could nest additional calls around strftime if you wanted, like zipping the timestamp to another value or wrapping it in an if clause, etc. Alternatively, convert can do a lot out of the box (take a look at the functions here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Convert#Syntax).

As far as this use case goes, if you can get both of them to return the time format you want, I'd inspect the job and see which runs faster. I imagine it will be negligible, but you might find one to be slightly more performant than the other. I personally prefer convert out of the box because I can write it quicker than an eval + strftime clause 🙂

Hope this helps!

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...