Eval value depending on hour of day

[jacqu3sy]

Is there a way to return a specific value if an event is seen between 18:00 and 07:00 the following day?

I need to generate a different value if something occurs overnight.

Was originally thinking of an eval with a > than, but then 02:00 would be less than 11pm so I'm confused as to whether it's possible!

Thanks.

[gcusello · Accepted solution]

Hi @ jacqu3sy,
eval command is your solution:

your_search
| eval check=if(date_hour>17 OR date_hour<8,"1","2")
| ...

Ciao and merry Christmas.
Giuseppe

[jacqu3sy]

Perfect. Many thanks. Have a great Xmas.