I got it to work so far:
| eval yesterday=strftime(relative_time(time(), "-d"), "%Y%m%d")
| where filedate=yesterday
I will create a macro soon.
To be clear, you are saying that the eval does this yesterday calculation for every event, whereas, the macro, will expand once per search?
... View more