Splunk Search

convert mktime() Vs eval strptime() Which is faster and better

strive
Influencer

Hi,

We can use convert mktime() or eval strptime() to convert time into epoch time format. I am more interested in knowing which is better and faster.

Consider a scenario where 50GB or 100GB of log events are indexed per day. In this case which one do you recommend.

Thanks

Strive

Tags (2)
0 Karma

RMartinezDTV
Path Finder

The answer lies in the difference between convert and eval, rather than between mktime() and strptime(). Eval-based commands irrevocably alter the field's data while convert is more of a "visual gloss" in that the field retains the original data and only the view/UI shows the converted value.

In most cases, this won't matter but might be important to consider if you're running jobs, reports, etc. in some method besides a human looking at a screen.

somesoni2
SplunkTrust
SplunkTrust

I think you're explaining difference between eval and fieldformat command. The convert command updates the original field value (or creates a new if AS clause is used), not just the UI show like fieldformat.

You're correct about the answer lies int eh difference between convert and eval. You can update only one field at a time in eval whereas in convert you can update multiple fields and/or use wildcard in the field names. I don't think there is much different in speed between mktime and strptime.

Drainy
Champion

It looks like you've come to your answer. I don't think there is really much difference and in fact I suspect they probably use pretty much the same libraries on the backend, just exposed slightly differently.

Just an aside, which sowings seemed to be moving to. _time is already in epoch, there is some magical javascript that just recognises when _time is on screen and changes it to a readable format, try doing a rename on _time and using the new name in a table, it will suddenly be an epoch!

strive
Influencer

I tested both with log volume of 4.2 million records. I did not see much difference.. convert was faster by fraction of seconds.

0 Karma

strive
Influencer

Yes expressing _time field in epoch format. Also we have some time fields in logs. Session start time, session end time etc...

0 Karma

sowings
Splunk Employee
Splunk Employee

Are you talking about expressing the _time field in epoch format? Or did you mean some other field?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...