Thanks for the quick reply! One correction to something I said earlier: the format of the "Date" in my lookup file is YYYY-MM-DD. It is in the same dashboard. I tried what you had mentioned already, but with the global parameters within quotes. That didn't seem to return what I wanted, but it did not lead to an error. Then I tried without quotes, and I get this error: Error in 'where' command: The operator at 'mon@mon AND Date<=@mon ' is invalid. The where clause is like: where customer="XYZ" AND Date>=$global_time.earliest$" AND Date<=$global_time.latest$" I've also tried this: | inputlookup mylookup.csv | eval lookupfiledatestart =strftime($global_time.earliest$, "%Y-%m-%d") | eval lookupfiledateend =strftime($global_time.latest$, "%Y-%m-%d") | where client="XYZ" AND Date>=lookupfiledatestart AND Date<=lookupfiledateend That gives me this error: Error in 'EvalCommand': The expression is malformed. An unexpected character is reached at '@mon, "%Y-%m-%d")'. ... View more

Yup that could work! Do you need help with crafting the rest of the search? ... View more

Hi @vm_molson, For sure the problem is because of space. In regex, all options should be defined specifically in order to lower false positive matches. Based on your sample events below should work; | eval yesterday=now()-86400 | eval yesterday=strftime(yesterday,"%Y%m%d") | where match(filename, "[_\.]".'yesterday'."[_\.\s]") Or if you sure there is no other date in the file you can use below; | eval yesterday=now()-86400 | eval yesterday=strftime(yesterday,"%Y%m%d") | where match(filename, ".+".'yesterday'.".+")     ... View more