Re: create new field

mananzeh · ‎08-12-2022

how can solve this ::: (Create a new field called "StartTime" and set the value to seven days ago from today, snapped to the beginning of the day) ???

richgalloway · ‎08-12-2022

Use the eval command to create a new field. The relative_time function can be used to compute a new timestamp using another timestamp and an interval.

| eval StarTime = relative_time(now(), "-7d@d")

---
If this reply helps you, Karma would be appreciated.

ITWhisperer · ‎08-12-2022

| eval StartTime=relative_time(now(),"-7d@d")

How to create new field?

eval

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

How to create new field?

eval

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever