hi @knitz,
Subtract 86400 (seconds for 1 day) from now().
| eval filename=strftime(now()-86400, "Application-license-usage-per_day_%d.csv")
... View more
You already this question. Please refer to: https://answers.splunk.com/answers/807806/return-yesterday-count-on-eval-filenamestrftimenow.html
... View more