Splunk Enterprise

Splunk search

LolabhattuA
Loves-to-Learn

Can some one help me in building a Splunk search with the below mentioned criteria!.

My application contains some fields and one of the field is "Request Number". I want the search query to fetch the records which have "Request Number" as "0".

I have the source name, Host name etc. I'm getting other results also, But no Requet number as 0. Can someone help me out here.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=yourindex
| where 'Request Number' = 0
0 Karma

LolabhattuA
Loves-to-Learn

This isn't returning any results.

0 Karma

SinghK
Builder

Index = * | search "Request Number"=0

0 Karma

SinghK
Builder

Please post some test data to test the query if its not sensitive data.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...