How to create after hour report?

[Johnsonbc]

I am trying to create an after hour query with specific time frames 1. Mon 0000-0700 and 1900-2400, 2. Tue 0000-0700 and 1900-2400, 3. Wed 0000-0700 and 1900-2400, Thur 0000-0700 and 1900-2400, Fri 0000-0700 and 1900-2400, Sat 0000-2400, and Sun 0000-2400. I have my Cron Express set for 43 10*** 

| sort - _time

| eval user=lower(user)

|eval Day=strftime(_time,”%A”)

|eval Hour=strftime(_time,”%H”)

|eval Date=strftime(_time,”Y-%m-%d”)

| search Hour IN (19,20,21,22,23,24,0,1,2,3,4,5,6,7)

| table Date, Day, Hour, “User Account”

I like the way this is displayed but I cannot figure out how to combine this query with a weekend (FRI 1900-Mon 0700) query. Or will I have to have two different queries? Once completed this will make a good dashboard. 

[richgalloway]

Use OR to test for weekend days or weekday hours.

| sort - _time
| eval user=lower(user)
| eval Day=strftime(_time,”%A”)
| eval Hour=strftime(_time,”%H”)
| eval Date=strftime(_time,”Y-%m-%d”)
| search Day IN (Saturday Sunday) OR Hour IN (19,20,21,22,23,24,0,1,2,3,4,5,6,7)
| table Date, Day, Hour, “User Account”

[Johnsonbc]

That work but it is not capturing 24 hours on Sat & Sun (0000-2400). It is only doing my week day Hours IN 

[richgalloway]

It appears to capture the right times for me.

[Johnsonbc]

I think the reason it was not working for me is because I am running a PIVOT. I was having issues running "Earliest & Latest" and other time & date commands.

[Johnsonbc]

It was not working for me so, I created a dashboard with (Mon-Fri) so far. 

| sort - _time

| eval user=lower(user)

|eval Day=strftime(_time,”%A”)

|eval Hour=strftime(_time,”%H”)

|eval Date=strftime(_time,”Y-%m-%d”)

| search Day IN (Monday) Hour IN (0,1,2,3,4,5,6,19,20,21,22,23)

| stats sum(user)

This gives me the number of user that log on after hours Mon-Fri and can drill down if need to. Still working on the weekend hours.