I am running below search; daily (last 24h) .... which returns results and "outputlookup" results into a csv based on "xyzNOof_day"
Runs fine....if I am running such search on same day (i.e. close to midnight) but the source get inputs after midnight so I miss data and had to run such search next day..... i.e. running 04:30am following day
Running next day same search and setting it will return a file name based of the day (next-day)
So I like to run the search on next day.... i.e. running the search on day 09 @ 04:30am (search day before, which is day8) ... it should | eval filename=strftime(now(), "Application-license-usage-perday%d.csv") %d must be counted as the day before =8 not 9.