How to exclude events if results from entire day returns zero?

[dzyfer]

I need to exclude events from a timechart only if they fulfill 2 conditions:

the field returns 0 for ALL events in the entire day (24hours) AND the days are weekends (Saturday & Sunday)

I have tried 

| date_wkend = strftime(_time,"%A")
| search NOT (date_wkend = "Saturday" AND varA = 0)
| search NOT (date_wkend = "Sunday" AND varA = 0)

However this also excludes the events from a weekend that has some non-zero results for varA, and since I have to do some further calculations based on a full-day span, my calculations are inaccurate.

[PickleRick · Accepted solution]

Half of the solution is almost there (filtering on weekday). You need the other half. Something like that if you want to account for the events which do not have my_var values at all, you'd probably have to fiddle with fillnull.

| date_wkend = strftime(_time,"%A")
| bin _time span=1d as timehelper
| eventstats dc(my_var) as dc by timehelper
| where NOT ((date_wkend="saturday" OR date_wkend="sunday") AND dc=1 AND my_var=0)