Splunk Search

What is better for the conversion, eval or convert?

danielbb
Motivator

We wonder what is better for this query -

index=_audit action=alert_fired ss_app=<app name> 
| stats count as TotalEvents max(triggered_alerts) as TotalFires max(_time) as MostRecent by ss_name severity alert_actions 
| convert ctime(MostRecent) 
| sort - TotalFires

| convert ctime(MostRecent) or | eval formatted_time=strftime(MostRecent, "%H:%M:%S %d-%m-%Y") ?

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Actually, neither. In the vast majority of cases, you should be using fieldformat:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat

View solution in original post

woodcock
Esteemed Legend

Actually, neither. In the vast majority of cases, you should be using fieldformat:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat

aberkow
Builder

They largely offer the same functionality for this use case - converting an epoch timestamp into a timestamp format of your choosing. You can rename with either (an AS clause in the convert call or with a new variable in eval) or override the initial variable value. Both offer the ability to specify a timeformat as well (one with the timeformat argument and the other as part of the strftimefunction).

Where they differ is in additional functionality outside of this specific use case. An eval function can do more than just this in one line - you could nest additional calls around strftime if you wanted, like zipping the timestamp to another value or wrapping it in an if clause, etc. Alternatively, convert can do a lot out of the box (take a look at the functions here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Convert#Syntax).

As far as this use case goes, if you can get both of them to return the time format you want, I'd inspect the job and see which runs faster. I imagine it will be negligible, but you might find one to be slightly more performant than the other. I personally prefer convert out of the box because I can write it quicker than an eval + strftime clause 🙂

Hope this helps!

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...