Before tye's reply made it redundant, I wrote a regex to parse the print message. FYI, it was: 

my $digits_re = qr{ \d+ }msx;

my $words_re  = qr{
    \S+
    (?: \s+ \S+)*
}msx;

my $print_message_re = qr{
  \A
         Document               [ ]  ( $digits_re ) , 
                                [ ]  ( $words_re  )
    [ ]  owned [ ] by           [ ]  ( $words_re  )
    [ ]  was [ ] printed [ ] on [ ]  ( $words_re  )
    [ ]  via [ ] port           [ ]  ( $words_re  ) \.
    [ ]+ Size [ ] in [ ] bytes: [ ]  ( $digits_re ) ;
    [ ]  pages [ ] printed:     [ ]  ( $digits_re )
    \s*
  \z
}msx;

[download]

Here is a cleaned-up and refactored solution to your problem.
Working, tested code: 

#!/usr/bin/perl
use strict;
use warnings;
use Win32::EventLog;
use constant ONE_DAY => 24 * 60 * 60;

my $yesterday = time() - ONE_DAY;
my $wanted_date   = format_date( $yesterday );
my $wanted_host   = $ENV{ComputerName};
my $wanted_log    = 'System';
my $wanted_source = 'Print';
print "Wanted Date  : $wanted_date\n";
print "Wanted Host  : $wanted_host\n";
print "Wanted Log   : $wanted_log\n";
print "Wanted Source: $wanted_source\n";

my $handle = Win32::EventLog->new( $wanted_log, $wanted_host )
  or die "Can't open '$wanted_log' EventLog from '$wanted_host'\n";

$handle->GetNumber( my $recs )
  or die "Can't get number of EventLog records\n";

$handle->GetOldest( my $base )
  or die "Can't get number of oldest EventLog record\n";

my $read_flags = EVENTLOG_FORWARDS_READ
               | EVENTLOG_SEEK_READ;

foreach my $event_id ( $base .. ( $base + $recs - 1 ) ) {

    $handle->Read( $read_flags, $event_id, my $event_href )
      or die "Can't read EventLog entry# $event_id\n";

    next if $event_href->{Source} ne $wanted_source;

    my $event_date = format_date( $event_href->{'TimeGenerated'} );
    next if $event_date ne $wanted_date;

    my ( $doc_num, $doc_name, $owner, $device, $port, $size, $pages )
        = split "\x00", $event_href->{Strings};

    printf(
        "%7d\t%15d\t%-15s\t%-7s\t%-23s\t%7d\t%s\n",
        $pages, $size, $owner, $port, $device,
        $doc_num, $doc_name,
    );

}

sub format_date {
    die "Wrong number of arguments" if @_ != 1;
    my ($time) = @_;

    my ( $day, $month, $year ) = (localtime $time)[3..5];

    return sprintf(
        '%04d-%02d-%02d',
        $year+1900, $month+1, $day
    );
}

[download]

In reply to Re: Extracting useful information from Windows Event Logs by Util
in thread Extracting useful information from Windows Event Logs by saadatsaeed

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.