https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691207#M235389 <P>How do I add a&nbsp; new field and set the value to seven days ago from the current date, snapped to the<BR />beginning of the current date? I know the date syntax should be "earliest=-7d@d", but am unsure if I should use the eval command to add the field and the specific syntax. Thanks.&nbsp;</P> Thu, 20 Jun 2024 19:43:51 GMT Substance82 2024-06-20T19:43:51Z https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691207#M235389 <P>How do I add a&nbsp; new field and set the value to seven days ago from the current date, snapped to the<BR />beginning of the current date? I know the date syntax should be "earliest=-7d@d", but am unsure if I should use the eval command to add the field and the specific syntax. Thanks.&nbsp;</P> Thu, 20 Jun 2024 19:43:51 GMT https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691207#M235389 Substance82 2024-06-20T19:43:51Z https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691210#M235390 <P><FONT face="courier new,courier">eval</FONT> is the command to use to add a new field to an event.&nbsp; Use the <FONT face="courier new,courier">relative_time</FONT> function to help set the value.</P><LI-CODE lang="markup">| eval newField = relative_time(now(), "-7d@d")</LI-CODE><P>&nbsp;</P> Thu, 20 Jun 2024 20:12:35 GMT https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691210#M235390 richgalloway 2024-06-20T20:12:35Z https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691214#M235393 <P>Thanks a million!</P> Thu, 20 Jun 2024 20:41:07 GMT https://community.splunk.com/t5/Splunk-Search/Adding-and-defining-the-value-for-a-new-Search-Field/m-p/691214#M235393 Substance82 2024-06-20T20:41:07Z