Specifying today's date in the source file on a search

[DavidGuarneri]

Is there a way to specify today's date in the filename of the source on the search? I'm thinking in the same way you would put it in a bash script. Pseudocode:

source="C:logs\\path\\iislog_(time(%y%m%d)).log"

[yannK]

use the function now() in a subsearch or a macro.

the search to generate a condition :

| stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source

the search using the sub search to generate a source condition

* [ | stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source]

you could improve by using a macro too.

[Ayn]

Use a subsearch:

[| stats count | eval source="C:\\logs\\path\\iislog".strftime(now(),"%y%m%d").".log" | fields source]

[DavidGuarneri]

That worked, thank you!

[yannK]

You are a kung fu master Ayn !