Splunk Search

Is it possible to use EVAL field in sendemail with DBXQUERY search?


I am needing to pass a custom date to the sendemail subject line and I know it is possible using a standard Splunk search and 'eval' but I have been unable to do it using a dbxquery search.
I am only able to add the custom date to the dbxquery select statement and pass it to sendemail using the 'fields' option but I would prefer not to have to add an extra field to my dbxquery.

Is there a way to use 'eval', or something else, to create a custom date field and add it to sendemail using a dbxquery as a search?

0 Karma