Hello. I am interested in data that occurs from Tuesday night on 8 PM until 6 AM. The caveat is that I need 2 separate time periods to compare. One of which is the 2nd Tuesday of each month until the 3rd Thursday. The other is any other day in the month.  So far I have:  | eval day_of_week=strftime(_time, "%A") | eval week_of_month=strftime(_time, "%U" ) | eval day_of_month=strftime(_time, "%d") | eval start_target_period=if(day_of_week=="Tuesday" AND week_of_month>1 AND week_of_month<4, "true", "false") | eval end_target_period=if(day_of_week=="Thursday" AND week_of_month>2 AND week_of_monthr<4, "true", "false") | eval hour=strftime(_time, "%H") | eval time_bucket=case( (start_target_period="true" AND hour>="20") OR (end_target_period="true" AND hour<="06"), "Target Period", (hour>="20" OR hour<="06"), "Other Period" ) My issue is that my "week of month" field is reflecting the week of the year. Any help would be greatly appreciated.  EDIT: I placed this in the wrong location, all apologies.  ... View more