Can any one help with a search language that could determine system logins after core hours?

[essibong1]

Can any one help with a search language that could determine system logins after core hours?

[to4kawa]

index=your_index EventCode=7001 OR EventCode=7002 sourcetype=wineventlog
| eval core_time_start="08:00:00", core_time_end="17:00:00"
| foreach core_time*
    [eval <<FIELD>> = tonumber(strftime(strptime('<<FIELD>>',"%T"),"%H%M%S"))]
| where tonumber(strftime(_time,"%H%M%S")) < core_time_start OR tonumber(strftime(_time,"%H%M%S")) > core_time_end

Hi, @essibong1

1. your system
2. your core time
3. your log

I do not know the details.
This query provides non-standard Windows logon and logoff times logs.