Splunk DB Connect 1: Can I run dbquery with a variable?

[stepheneardley]

I need to schedule a report which runs dbquery, but I need that report to run with a variable in the query e.g.

| eval myVar=stuff
| dbquery source "select * from table where timestamp >= '".myVar."'"

Or something like that, but of course this doesn't work since dbquery must be the first command of a search.

Has anyone come across this before or found a way around it?

[somesoni2 · Accepted solution]

You can try like this (using map command)

| gentimes start=-1 | eval myVar=stuff | map search="| dbquery source \"select * from tble where timestamp >= $myVar$ \" "

[stepheneardley]

Worked a treat. Thanks. I can't figure out what gentimes is used for though.