I am looking for syntax to writing a queue about search the log event only happen on Saturday and Sunday and during the weekday after 18:00. what is the key work should I use, Could anyone give me a hint please?
Hi Dineshrja9
Thank you for your answer. I tried your commend but it doesn't return me any result and I find out it is because the index I am trying search doesn't have date_wday field as below images show
the index1 file I am trying to search, I can not expend _time field search this index with command date_wday does not return me result.
the other index2 which contain date_wday field. search this index with command date_wday it can return me result.
Any suggestion about how can I get that date_wday field added into the index1 file?
Hi Dineshrja9
Thank you for your answer. I tried your commend but it doesn't return me any result and I find out it is because the index I am trying search doesn't have date_wday field as below images show
the index1 file I am trying to search, I can not expend _time field search this index with command date_wday does not return me result.
the other index2 which contain date_wday field. search this index with command date_wday it can return me result.
Any suggestion about how can I get that date_wday field added into the index1 file?
My bad, some of the events don't contain these fields by default(like the windows event logs). You can create these fields and then use it -
<your search> | eval date_hour=strftime(_time,"%H") | eval date_wday=strftime(_time,"%A") | search (date_hour>18 AND date_hour<=23) OR (date_wday="Saturday" OR date_wday="Sunday")
Thank you so much for your help
You can add this to your base search
(date_hour>18 AND date_hour<=23) OR (date_wday="saturday" OR date_wday="sunday")