How to create new field?

[mananzeh]

how can solve this ::: (Create a new field called "StartTime" and set the value to seven days ago from today, snapped to the beginning of the day) ???

[richgalloway]

Use the eval command to create a new field.  The relative_time function can be used to compute a new timestamp using another timestamp and an interval.

| eval StarTime = relative_time(now(), "-7d@d")

[ITWhisperer]

| eval StartTime=relative_time(now(),"-7d@d")