I am trying to create an after hour query with specific time frames 1. Mon 0000-0700 and 1900-2400, 2. Tue 0000-0700 and 1900-2400, 3. Wed 0000-0700 and 1900-2400, Thur 0000-0700 and 1900-2400, Fri 0000-0700 and 1900-2400, Sat 0000-2400, and Sun 0000-2400. I have my Cron Express set for 43 10***
| sort - _time
| eval user=lower(user)
|eval Day=strftime(_time,”%A”)
|eval Hour=strftime(_time,”%H”)
|eval Date=strftime(_time,”Y-%m-%d”)
| search Hour IN (19,20,21,22,23,24,0,1,2,3,4,5,6,7)
| table Date, Day, Hour, “User Account”
I like the way this is displayed but I cannot figure out how to combine this query with a weekend (FRI 1900-Mon 0700) query. Or will I have to have two different queries? Once completed this will make a good dashboard.
Use OR to test for weekend days or weekday hours.
| sort - _time
| eval user=lower(user)
| eval Day=strftime(_time,”%A”)
| eval Hour=strftime(_time,”%H”)
| eval Date=strftime(_time,”Y-%m-%d”)
| search Day IN (Saturday Sunday) OR Hour IN (19,20,21,22,23,24,0,1,2,3,4,5,6,7)
| table Date, Day, Hour, “User Account”
That work but it is not capturing 24 hours on Sat & Sun (0000-2400). It is only doing my week day Hours IN
It appears to capture the right times for me.
I think the reason it was not working for me is because I am running a PIVOT. I was having issues running "Earliest & Latest" and other time & date commands.
It was not working for me so, I created a dashboard with (Mon-Fri) so far.
| sort - _time
| eval user=lower(user)
|eval Day=strftime(_time,”%A”)
|eval Hour=strftime(_time,”%H”)
|eval Date=strftime(_time,”Y-%m-%d”)
| search Day IN (Monday) Hour IN (0,1,2,3,4,5,6,19,20,21,22,23)
| stats sum(user)
This gives me the number of user that log on after hours Mon-Fri and can drill down if need to. Still working on the weekend hours.