SPL query exclusion/inclusion

[auzark]

Will someone please confirm the exclusion/inclusion that occurs based on the below statement.

The way I interpret the below statement is 
*No events that occur on Monday or Thursday that occur before 07:00 
*No events that occur on Monday or Thursday that occur after 09:00 
*All events for other days of the week regardless of time
*Exclude any events from the 1st day of the month regardless of day of the week or time

|eval date_wday=strftime(epochtime,"%w")| eval day_sat=strftime(_time,"%A")|eval time=strftime(_time,"%H:%M") | eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d")
| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

[scelikok]

Hi @auzark, below query should work;

| eval date_wday=strftime(epochtime,"%w") 
| eval day_sat=strftime(_time,"%A") 
| eval time=strftime(_time,"%H") 
| eval MonthDay=strftime(_time,"%d")
| eval Day1ofWeek = strftime(relative_time(_time,"@w0"),"%m/%d") 
| where NOT ((day_sat="Monday" OR day_sat="Thursday") AND (time < "07" OR time > "09")) AND MonthDay!="01"

If this reply helps you an upvote is appreciated.

[auzark]

Hi @scelikok,

I appreciate your reply and I'll give that a try.

Could you tell me what you think the query I posted does?

btw... Merry Christmas!

[scelikok · Accepted solution]

Hi @auzark, 

| where NOT IN(day_sat ,"Monday", "Thursday") OR time < "07:00" OR time > "09:00" OR day_number !=1

Your query will return only events that time < "07:00" OR time > "09:00" regardless of the day. Since NOT covers only the first comparison, it will try to filter Monday and Thursday but the OR statements coming after that will not allow that. I changed time format to keep only hour to make time comparison safer. Also day_number is not a default field, that is why I calculated as MonthDay variable.

I hope I could explained well.

Merry Christmas!

[auzark]

Hi @scelikok,

Thanks, Perfectly clear explanation.