How to use where clause in my search string in Splunk Enterprise

Question

I have a search string like below:

index=qrp STAGE IN (ORDER_EVENT) | bucket _time span=1h | timechart useother=f span=1h sum(TRADES) as "TradeCount" by ODS_SRC_SYSTEM_CODE | fillnull value=0

And this is currently giving me aggregates of trades for multiple source systems from the stage table Trade event in a tabular format for every hour of the day.

I need to search exactly for the time frame 8am every day, whether the value of sun of trade for all source systems in the table is equal to zero. How to add the condition to check the column value is Zero or not?

Your help is much appreciated.

Answer 1

You can use the where command to test the value of a field.

... | where TradeCount == 0