We wonder what is better for this query -
index=_audit action=alert_fired ss_app=<app name>
| stats count as TotalEvents max(triggered_alerts) as TotalFires max(_time) as MostRecent by ss_name severity alert_actions
| convert ctime(MostRecent)
| sort - TotalFires
| convert ctime(MostRecent)
or | eval formatted_time=strftime(MostRecent, "%H:%M:%S %d-%m-%Y")
?
Actually, neither. In the vast majority of cases, you should be using fieldformat
:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat
Actually, neither. In the vast majority of cases, you should be using fieldformat
:
https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Fieldformat
They largely offer the same functionality for this use case - converting an epoch timestamp into a timestamp format of your choosing. You can rename with either (an AS
clause in the convert
call or with a new variable in eval
) or override the initial variable value. Both offer the ability to specify a timeformat as well (one with the timeformat
argument and the other as part of the strftime
function).
Where they differ is in additional functionality outside of this specific use case. An eval
function can do more than just this in one line - you could nest additional calls around strftime
if you wanted, like zipping the timestamp to another value or wrapping it in an if clause, etc. Alternatively, convert
can do a lot out of the box (take a look at the functions here https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Convert#Syntax).
As far as this use case goes, if you can get both of them to return the time format you want, I'd inspect the job and see which runs faster. I imagine it will be negligible, but you might find one to be slightly more performant than the other. I personally prefer convert
out of the box because I can write it quicker than an eval
+ strftime
clause 🙂
Hope this helps!