eval expression to create a field with values more than other field

[changux]

Hi all.

I have a field called src with values like:

348
55666
77666
95670
23456

I want to create a new field that only shows the values that are greater than 1000, my search string looks like:

... | where src > 1000

I tried directly with ... | eval field= where src > 1000 and doesn't work. Also, tested with eval field=command(search subsearch) and also doesn't work.

Suggestions?

[somesoni2 · Accepted solution]

Not sure what you're trying to achieve here. Do you want to create a new field if the value of src is greater than 1000 and store the value of src in the new field? If yes then try this

...| eval newfield=if(src>1000,src,null())