...
Multiple levels of brackets are supported - in this case, we are looking for login events by AJSmith from systems that start with AU, US or UK, on either the weekend, or out of normal work hours during the week.
To search for some IP addresses you will need to use the advanced search and escape the dot in the IP address as per this example
DATE='TODAY' AND ALLFIELDS REGEXI '(10\1\.1\.1|10\.1\.1\.2) '
Restricted words and characters
...