convert mktime() Vs eval strptime() Which is faster and better

[strive]

Hi,

We can use convert mktime() or eval strptime() to convert time into epoch time format. I am more interested in knowing which is better and faster.

Consider a scenario where 50GB or 100GB of log events are indexed per day. In this case which one do you recommend.

Thanks

Strive

[RMartinezDTV]

The answer lies in the difference between convert and eval, rather than between mktime() and strptime(). Eval-based commands irrevocably alter the field's data while convert is more of a "visual gloss" in that the field retains the original data and only the view/UI shows the converted value.

In most cases, this won't matter but might be important to consider if you're running jobs, reports, etc. in some method besides a human looking at a screen.

[somesoni2]

I think you're explaining difference between eval and fieldformat command. The convert command updates the original field value (or creates a new if AS clause is used), not just the UI show like fieldformat.

You're correct about the answer lies int eh difference between convert and eval. You can update only one field at a time in eval whereas in convert you can update multiple fields and/or use wildcard in the field names. I don't think there is much different in speed between mktime and strptime.

[Drainy]

It looks like you've come to your answer. I don't think there is really much difference and in fact I suspect they probably use pretty much the same libraries on the backend, just exposed slightly differently.

Just an aside, which sowings seemed to be moving to. _time is already in epoch, there is some magical javascript that just recognises when _time is on screen and changes it to a readable format, try doing a rename on _time and using the new name in a table, it will suddenly be an epoch!

[strive]

I tested both with log volume of 4.2 million records. I did not see much difference.. convert was faster by fraction of seconds.

[strive]

Yes expressing _time field in epoch format. Also we have some time fields in logs. Session start time, session end time etc...

[sowings]

Are you talking about expressing the _time field in epoch format? Or did you mean some other field?