Splunk Search

eval expression to create a field with values more than other field

changux
Builder

Hi all.

I have a field called src with values like:

348
55666
77666
95670
23456

I want to create a new field that only shows the values that are greater than 1000, my search string looks like:

... | where src > 1000

I tried directly with ... | eval field= where src > 1000 and doesn't work. Also, tested with eval field=command(search subsearch) and also doesn't work.

Suggestions?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Not sure what you're trying to achieve here. Do you want to create a new field if the value of src is greater than 1000 and store the value of src in the new field? If yes then try this

...| eval newfield=if(src>1000,src,null())

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Not sure what you're trying to achieve here. Do you want to create a new field if the value of src is greater than 1000 and store the value of src in the new field? If yes then try this

...| eval newfield=if(src>1000,src,null())
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...