how can solve this ::: (Create a new field called "StartTime" and set the value to seven days ago from today, snapped to the beginning of the day) ???
Use the eval command to create a new field. The relative_time function can be used to compute a new timestamp using another timestamp and an interval.
| eval StarTime = relative_time(now(), "-7d@d")
| eval StartTime=relative_time(now(),"-7d@d")