Splunk Search

Is it possible to use EVAL field in sendemail with DBXQUERY search?

jnsd03
Explorer

I am needing to pass a custom date to the sendemail subject line and I know it is possible using a standard Splunk search and 'eval' but I have been unable to do it using a dbxquery search.
I am only able to add the custom date to the dbxquery select statement and pass it to sendemail using the 'fields' option but I would prefer not to have to add an extra field to my dbxquery.

Is there a way to use 'eval', or something else, to create a custom date field and add it to sendemail using a dbxquery as a search?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...