I found a successful solution to this issue. Basically the dbxquery contains primarily SQL query language and did not respond properly to common splunk search language. In short, you really need to make this work with SQL language (not my forte).
In the DB Connect 3.1.1 app, Data Lab>SQL Explorer you can input your SQL code until you get the results you want, and it spits out the Splunk search string on the right, where you can "open in search". This provides the working search string.
Also, saving as a real-time alert would not work, so I set it up on a 30 minute cron schedule, which is */30 * * * * , and the search string looks back 31 mins from NOW to catch the desired events.
| dbxquery query="SELECT * FROM \"SQLCrypto\".\"dbo\".\"ProcessLog\" WHERE [Message] LIKE '%![IsSuccess!]:False%' ESCAPE '!') AND [Created] BETWEEN DATEADD(MINUTE,-31,GETDATE()) AND GETDATE() ORDER BY [Id] DESC " connection="SQL"
... View more