如何在 Splunk Enterprise 的搜索字符串中使用 where 子句

Question

I have a search string like below:

index=qrp STAGE IN (ORDER_EVENT) | bucket _time span=1h | timechart useother=f span=1h sum(TRADES) as "TradeCount" by ODS_SRC_SYSTEM_CODE | fillnull value=0

And this is currently giving me aggregates of trades for multiple source systems from the stage table Trade event in a tabular format for every hour of the day.

I need to search exactly for the time frame 8am every day, whether the value of sun of trade for all source systems in the table is equal to zero. How to add the condition to check the column value is Zero or not?

Your help is much appreciated.

Answer 1

You can use the where command to test the value of a field.

... | where TradeCount == 0