Splunk Search

Is it possible to use EVAL field in sendemail with DBXQUERY search?

jnsd03
Explorer

I am needing to pass a custom date to the sendemail subject line and I know it is possible using a standard Splunk search and 'eval' but I have been unable to do it using a dbxquery search.
I am only able to add the custom date to the dbxquery select statement and pass it to sendemail using the 'fields' option but I would prefer not to have to add an extra field to my dbxquery.

Is there a way to use 'eval', or something else, to create a custom date field and add it to sendemail using a dbxquery as a search?

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...