Hi all.
I have a field called src
with values like:
348
55666
77666
95670
23456
I want to create a new field that only shows the values that are greater than 1000, my search string looks like:
... | where src > 1000
I tried directly with ... | eval field= where src > 1000
and doesn't work. Also, tested with eval field=command(search subsearch)
and also doesn't work.
Suggestions?
Not sure what you're trying to achieve here. Do you want to create a new field if the value of src is greater than 1000 and store the value of src in the new field? If yes then try this
...| eval newfield=if(src>1000,src,null())
Not sure what you're trying to achieve here. Do you want to create a new field if the value of src is greater than 1000 and store the value of src in the new field? If yes then try this
...| eval newfield=if(src>1000,src,null())