The fields available to the Description field are those produced by the correlation search. ... View more

Hi @avinasa, if you want toexclude only non working hours and weekends, you could use the solution from @smurf . If instead you want to manage also holydays, you have to create a lookup containing all the days in a year, called e.g. cal.csv with two columns: Day, Type. For the Day column choose a forma and use always the same. For the Type column, I usually use three values: 0 for working day, 1 for halp working day 2 for holydays. in this way you can insert in your search the condition: | eval Day=strftime(_time,"%d/%m/%Y") | lookup cal.csv Day OUTPUT Type | eval Hour=strftime(_time,"%H") | eval Minute=strftime(_time,"%M") | search Type=2 OR (Type=1 (Hour>14 OR (Hour<7 AND Minute<45))) OR (Type=0 (Hour>20 OR (Hour<8 AND Minute<45)))  I prefrered also created a macro do do this. Ciao. Giuseppe ... View more