I'm not sure this is doable directly, but you can cheat by splitting your data into two series:
eventtype="searchDC" Type="Audit Success" CategoryString="Logon/Logoff"
| stats count by user
| eval high=if(count>1000,count,0)
| eval low=count-high
| fields user,high,low
Replace 1000 with whatever you want your threshold number to be.
When you create your bar chart, set Stack Mode to 'stacked' and Multi-series mode to 'Combined' so that the empty bars don't leave gaps. The legend will also show two series ("high" and "low"), but you can always just turn the legend display off.
If you are using it in a dashboard and want a specific color, such as turning all of the "high" values red, take a look at this page: http://www.splunk.com/base/Documentation/4.1.5/Developer/AdvancedCharting