Tweak the days for your case (I did with Tue & Fri, because I tested it today (Tuesday)):
index=ndx sourcetype=srctp
| eval dow=strftime(_time,"%a")
| eval today=strftime(now(),"%a")
| eval keept=if(today="Tue","Fri,Sat,Sun,Mon","No")
| makemv delim="," keept
| eval keepf=if(today="Fri","Tue,Wed,Thu","No")
| makemv delim="," keepf
| eval keep=if((mvfind(keept,'dow')>=0 OR mvfind(keepf,'dow')>=0),"yes","no")
| search keep="yes"
| stats count by dow today
This adds 5 fields to each event ( dow , today , keept , keepf , keep ), and keeps events only if the event's day of the week ( dow ) is found in one of the multivalue keep[f|t] fields.
Fwiw, this will also "work" every day of the week - but it will only return results when you run it on either Tuesday or Friday (see the today field).
There are probably good ways to improve this, but it's fully-functional now.
... View more