Search within sub-time range

[ghnwmlguy]

I am trying to collect stats from login events from evening hours. I would like to run reports for any time range (last 60m, 7d, etc.) but only view results that show logons between the hours of 5pm and 7am.

[David]

You can add the following search criteria:

((date_hour > 17) OR (date_hour < 7))

And that should get you where you want to be. Personally, I use:

((date_wday="saturday" OR date_wday="sunday") OR (date_hour < 7 OR date_hour > 17))

You can then toss that in macros.conf like so:

[OffHours]
definition = ((date_wday="saturday" OR date_wday="sunday") OR (date_hour < 7 OR date_hour > 17))
iseval = 0

so you can just add in

`OffHours`

to your searches and have it automatically included.