For advanced evaluation like that you will probably need to do it within the search itself. You can use time functions to evaluate the current hour, and then add temporary fields to evaluate and further filter the search against. This may not be the most elegant solution, but I think it works. The important lines being the creation of the "smallHand" hour field; using it to set the filter field; and then applying the where filter.
| makeresults
| eval smallHand=strftime(now(), "%H"), field1="abc;def;ghi", field2="Lorem ipsum dolor sit amet"
| makemv field1 delim=";"
| mvexpand field1
| eval smallHand=if(field1="def" OR field1="ghi", "10", smallHand)
| eval filter=if(smallHand>=9 AND smallHand<11 AND field1="def", "True", "False")
| where filter!="True"
| fields - filter, smallHand
... View more