How to search the log event only happen on Saturday and Sunday and during the weekday after 18:00

[samlinsongguo]

I am looking for syntax to writing a queue about search the log event only happen on Saturday and Sunday and during the weekday after 18:00. what is the key work should I use, Could anyone give me a hint please?

[samlinsongguo · Accepted solution]

Hi Dineshrja9
Thank you for your answer. I tried your commend but it doesn't return me any result and I find out it is because the index I am trying search doesn't have date_wday field as below images show

the index1 file I am trying to search, I can not expend _time field search this index with command date_wday does not return me result.

the other index2 which contain date_wday field. search this index with command date_wday it can return me result.

Any suggestion about how can I get that date_wday field added into the index1 file?

[dineshraj9]

My bad, some of the events don't contain these fields by default(like the windows event logs). You can create these fields and then use it -

<your search> | eval date_hour=strftime(_time,"%H") | eval date_wday=strftime(_time,"%A")  | search (date_hour>18 AND date_hour<=23) OR (date_wday="Saturday" OR date_wday="Sunday")

[samlinsongguo]

Thank you so much for your help

[dineshraj9]

You can add this to your base search

(date_hour>18 AND date_hour<=23) OR (date_wday="saturday" OR date_wday="sunday")