Splunk Search

How to create new field?

mananzeh
New Member

how can solve this ::: (Create a new field called "StartTime" and set the value to seven days ago from today, snapped to the beginning of the day) ???

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the eval command to create a new field.  The relative_time function can be used to compute a new timestamp using another timestamp and an interval.

| eval StarTime = relative_time(now(), "-7d@d")

 

---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust
| eval StartTime=relative_time(now(),"-7d@d")
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...