Can anyone please help with constructing a search for notable events that came in outside of core hours?

[richgalloway · Accepted solution]

This query looks for notable events that did not come between 0800 and 1800.  Modify it as necessary for your core hours.

index=notable
| where NOT (_time >= relative_time(_time, "@d+8h") AND _time <= relative_time(_time, "@d+18h"))

[LionWolf]

This worked! Thank you so much! You taught me so much with this query!