On 22.11.2017 15:24, lfcrous wrote:
>
> Hi
>
> Is there a way to get a report for example 1 Jan 2017 till 30 Jan 2017
> between 18:00 till 06:00 am the next morning
>
> This is for user successful login sand failed logins
>
> We want to see if users have logged in during the night
>
> An example script will be great.


You can query they event store using the ObserverTZHour (estzhour)
field, e.g.:
estzhour:[18 TO 23] OR estzhour:[0 TO 5]

Note: Be sure to have the correct time zone configured on your event
sources.

--
Norbert