I used eval to create a field with the yesterday's date:
| eval today=strftime(now(),"%Y%m%d")
I want to search on events where the filename field contains that today variable / yesterday's date. The last 8 characters of a filename will contain the file date (ex: file20130628.csv).