Exclude Saturday and Sunday from monthly repirt

[priya0709]

I wanted to update my query to exclude Saturday and Sunday from attached query which is running for last 30 days

Please suggest

Query searches for host which generated event code 52 in last 30 days

[gcusello]

Hi @priya0709,

you could also add to your main search:

your_main_search NOT (date_wday="saturday" OR date_wday="sunday")
| ...

Ciao.

Giuseppe 

[ITWhisperer · Accepted solution]

--- your query
| eval dotw=tonumber(strftime(_time,"%w"))
| where dotw > 0 AND dotw < 6