Hi, I'm trying to calculate daily time shift baseline by this query
source="MySource" | eval ReportKey="Today" | eval d1AgoEarliest=relative_time(_time,"-1d@d")| eval d1AgoLatest=relative_time(_time,"-0d@d")| append [search source="MySource" starttimeu=d1AgoEarliest endtimeu=d1AgoLatest]
It retuns error d1AgoEarliest is not a valid value for starttimeu. It is not a positive floating point number.