I wanted to update my query to exclude Saturday and Sunday from attached query which is running for last 30 days
Please suggest
Query searches for host which generated event code 52 in last 30 days
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6
Hi @priya0709,
you could also add to your main search:
your_main_search NOT (date_wday="saturday" OR date_wday="sunday")
| ...
Ciao.
Giuseppe
I tried this and it still showed results for a stats or timechart output.
--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6