What is better for the conversion, eval or convert?

[danielbb]

We wonder what is better for this query -

index=_audit action=alert_fired ss_app=<app name> 
| stats count as TotalEvents max(triggered_alerts) as TotalFires max(_time) as MostRecent by ss_name severity alert_actions 
| convert ctime(MostRecent) 
| sort - TotalFires

| convert ctime(MostRecent) or | eval formatted_time=strftime(MostRecent, "%H:%M:%S %d-%m-%Y") ?

[woodcock · Accepted solution]

Actually, neither. In the vast majority of cases, you should be using fieldformat:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat

[aberkow]

They largely offer the same functionality for this use case - converting an epoch timestamp into a timestamp format of your choosing. You can rename with either (an AS clause in the convert call or with a new variable in eval) or override the initial variable value. Both offer the ability to specify a timeformat as well (one with the timeformat argument and the other as part of the strftimefunction).

Where they differ is in additional functionality outside of this specific use case. An eval function can do more than just this in one line - you could nest additional calls around strftime if you wanted, like zipping the timestamp to another value or wrapping it in an if clause, etc. Alternatively, convert can do a lot out of the box (take a look at the functions here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Convert#Syntax).

As far as this use case goes, if you can get both of them to return the time format you want, I'd inspect the job and see which runs faster. I imagine it will be negligible, but you might find one to be slightly more performant than the other. I personally prefer convert out of the box because I can write it quicker than an eval + strftime clause 🙂

Hope this helps!