Thank you for your help.
This is really close. The search you've provided will include IP addresses that have zeroes in particular days.
If I limit the Time Period to a specific date range (May 2nd through May 6th for my next example) I can make it work by using the day-of-the-week names as column headers and putting those into the where clause:
sourcetype=weblogs uri="/search/*" | bin span=1d _time as datefield | eval datefield = strftime(datefield, "%a") | chart count over srcip by datefield | where Mon>0 AND Tue>0 AND Wed>0 AND Thu>0 AND Fri>0
Thanks for your help!
... View more