doc/userguide: add example with non-zero offset for relative isdataat

Ticket: #8031.
(cherry picked from commit 2d662538e5)

doc/userguide/rules/payload-keywords.rst

@@ -300,6 +300,36 @@ As an example, consider a 32 byte payload:
 | ``isdataat:33,relative;`` | No     |
 +---------------------------+--------+
 
+Another example, consider the following payload:
+
+      +-------------------------------+
+Index | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+      +-------------------------------+
+Value | a | b | c | d | e | f | g | h |
+      +-------------------------------+
+
+Then the following rules match the payload as follows:
+
++----------------------------------------+--------+
+| Rule statement                         | Match? |
++----------------------------------------+--------+
+| ``isdataat:7;``                        | Yes    |
++----------------------------------------+--------+
+| ``isdataat:8;``                        | No     |
++----------------------------------------+--------+
+| ``isdataat:7,relative;``               | Yes    |
++----------------------------------------+--------+
+| ``isdataat:8,relative;``               | Yes    |
++----------------------------------------+--------+
+| ``isdataat:9,relative;``               | No     |
++----------------------------------------+--------+
+| ``payload:"c"; isdataat:4,relative;``  | Yes    |
++----------------------------------------+--------+
+| ``payload:"c"; isdataat:5,relative;``  | Yes    |
++----------------------------------------+--------+
+| ``payload:"c"; isdataat:6,relative;``  | No     |
++----------------------------------------+--------+
+
 A discussion of this difference can be found at
 https://redmine.openinfosecfoundation.org/issues/8031