Searching specific hour in Logger

[thoman]

I need to find out after office hours logon activities over one week period in Logger. I know it can be done in Logger report query (select ... where hour(endTime) < 8 and hour(endTime) > 18), but how can I do it in Logger search?

[rhope · Accepted solution]

My feeling is that from a workflow perspective, this is more a reporting task than a search task and there doesn't appear to be an easy way to do it, I can't find a way to parse out the hour from the endTime field (rex works on the RAW field and so gets a timestamp/seconds since epoch as input).  The best I could come up with was the following which is undocumented (the '-d -h' and the '-d +h' documentation only gives <current_period> [ +/- <units>] ) but appears to work.

_storageGroup IN ["Default Storage Group"] AND (

    (endTime >= "$Today - 6d - 6h" AND endTime <= "$Today - 6d + 8h") OR

    (endTime >= "$Today - 5d - 6h" AND endTime <= "$Today - 5d + 8h") OR

    (endTime >= "$Today - 4d - 6h" AND endTime <= "$Today - 4d + 8h") OR

    (endTime >= "$Today - 3d - 6h" AND endTime <= "$Today - 3d + 8h") OR

    (endTime >= "$Today - 2d - 6h" AND endTime <= "$Today - 2d + 8h") OR

    (endTime >= "$Today - 1d - 6h" AND endTime <= "$Today - 1d + 8h") OR

    (endTime >= "$Today - 6h" AND endTime <= "$Today + 8h"))

[thoman]

Thank you, Richard.