topic Search weekday during time, and include all weekend days in Splunk Search

Search weekday during time, and include all weekend days

Cmiddleton-oppd — Mon, 17 Jun 2024 21:27:27 GMT

Hello,
my current search is

index=winsec source=WinEventLog:Security EventCode=6272 | eval date_hour = strftime(_time, "%H") | where date_hour >= 19 OR date_hour <=06 | timechart count(src_user)

This provides me with a graph of logins made after hours. I want to expand the acceptable items to include the entire days of saturday/sunday as well. When I attempt to add this, i get "no results" what would be the best way to include that?

Re: Search weekday during time, and include all weekend days

richgalloway — Mon, 17 Jun 2024 21:02:14 GMT

Extract and test for the day of the week similar to how date_hour was done.

index=winsec source=WinEventLog:Security EventCode=6272 | eval date_hour = strftime(_time, "%H"), date_wday = strftime(_time, "%A") | where date_hour >= 19 OR date_hour <=06 OR date_wday = "Saturday" OR date_wday = "Sunday" | timechart count(src_user)

Re: Search weekday during time, and include all weekend days

Cmiddleton-oppd — Tue, 18 Jun 2024 13:16:54 GMT

I think this would work perfectly, but the system does not appear to have date_wday enabled. Using this term always provides me with " no results"

Re: Search weekday during time, and include all weekend days

glc_slash_it — Tue, 18 Jun 2024 14:07:33 GMT

The date_wday is being created with the eval command on the second line...

I'll break it down for you.

| eval date_hour = strftime(_time, "%H") | eval date_wday = strftime(_time, "%A")

Re: Search weekday during time, and include all weekend days

Cmiddleton-oppd — Tue, 18 Jun 2024 14:17:48 GMT

You're right! my mistake, I didn't read the entire query.

Thanks for pointing out my mistake!