We can use
convert mktime() or
eval strptime() to convert time into epoch time format. I am more interested in knowing which is better and faster.
Consider a scenario where 50GB or 100GB of log events are indexed per day. In this case which one do you recommend.
Yes expressing _time field in epoch format. Also we have some time fields in logs. Session start time, session end time etc...
I tested both with log volume of 4.2 million records. I did not see much difference.. convert was faster by fraction of seconds.
It looks like you've come to your answer. I don't think there is really much difference and in fact I suspect they probably use pretty much the same libraries on the backend, just exposed slightly differently.
The answer lies in the difference between convert and eval, rather than between mktime() and strptime(). Eval-based commands irrevocably alter the field's data while convert is more of a "visual gloss" in that the field retains the original data and only the view/UI shows the converted value.
In most cases, this won't matter but might be important to consider if you're running jobs, reports, etc. in some method besides a human looking at a screen.
I think you're explaining difference between eval and fieldformat command. The convert command updates the original field value (or creates a new if AS clause is used), not just the UI show like fieldformat.
You're correct about the answer lies int eh difference between convert and eval. You can update only one field at a time in eval whereas in convert you can update multiple fields and/or use wildcard in the field names. I don't think there is much different in speed between mktime and strptime.