Extract the week day and the hour from the timestamp, then check events that match your conditions. Something like this:
... | eval date_wday=strftime(_time,"%a") | eval date_hour=strftime(_time, "%H") | search (NOT (date_wday="Sat" OR date_wday="Sun") AND (date_hour>=20 OR date_hour<8)) OR date_wday="Sat" OR date_wday="Sun"
Note: the date_wday and date_hour fields are most often created automatically by Splunk, so if you're seeing that all your events already have these, you don't need to create themselves using eval like what I did above. However there are situations when they will not be created, so make sure first that you're not encountering that problem.
... View more