use the function now() in a subsearch or a macro.
the search to generate a condition :
| stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source
the search using the sub search to generate a source condition
* [ | stats count | eval date=strftime(now(),"%Y%m%d") | eval source="C:logs\\path\\iislog_".date.".log" | table source]
you could improve by using a macro too.
Use a subsearch:
[| stats count | eval source="C:\\logs\\path\\iislog".strftime(now(),"%y%m%d").".log" | fields source]
That worked, thank you!
You are a kung fu master Ayn !