creating a query with time\date variables

[udi-mosh]

Version

2.4.90

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

24

RAM

128

Storage for /

500GB

Storage for /nsm

6TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,
i am trying to create a query from cisco-ios integration that will find if there was a logon attempt out off work hours.
i was able to create the query that finds the logon message but i struggle with the date\time aspect.
10x

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

Have you tried clicking the clock icon to change to absolute time?
https://docs.securityonion.net/en/2.4/dashboards.html#time-picker

Before:

After:

[udi-mosh]

i am aware to this possibility but i do not want to use this. i am looking to build a query which in turn will used with visualization in a realtime dashboard configuration. for ex., i want to create a visualization that will show me if there was a login to a switch during non working hours.