I want the values of TID_now and TID_7 days ago in my table
I tried
| eval TID_7days=TID(now(), "-7d@d")
it says expression is malformed.
sample:
index=_internal (earliest=-8d@d latest=-7d@d) OR (earliest=-1d@d latest=@d) | eval date=strftime(_time,"%F") | chart count by sourcetype date
Incase if this is your requirement
|makeresults |eval TID_7days=relative_time(now(), "-7d@d") , TID_now=now()
What is TID in this context? Why have you labelled this rex when rex isn't mentioned?
