Alert when row count for two searches are not equal

[seomaniv]

I have two events: items received, and items acted on. I want to set an alert when the count by transactionID is not equal for the two searches. I have the search set up like so:

index=myIndex source=mySource 
| search criteriaForItemsReceived
| stats count as itemsReceived by transactionID
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | stats count as itemsProcessed by transactionID ]
| stats values(*) as * by transactionID

ok, it's a little more complicated, but this is the important part. So then need to compare itemsReceived to itemsProcessed to determine if there should be an alert. I have tried

... stats values(eval(itemsReceived-itemsProcessed)) as Difference ...
| search Difference != 0

as well as doing the eval before the stats, but everything I try ends up with null values for the eval, even though the table is properly populated with the values for itemsReceived and itemsProcessed (I have also tried convert num(itemsReceived) and tonumber(itemsReceived,10) in the event Splunk was not recognizing these fields as numbers, but each time, the fields are null).

What am I doing wrong here?

[richgalloway · Accepted solution]

The problem may be with the values(*) clause returning multi-field values, which most other functions can't handle.  Try this alternative:

index=myIndex source=mySource 
| search criteriaForItemsReceived
| eval state="Rcvd"
| append
    [ search index-myIndex source=mySource
    | search criteriaForItemsProcessed
    | eval state="Proc" ]
| stats count(eval(state="Rcvd")) as itemsReceived, count(eval(state="Proc")) as itemsProcessed by transactionID
| eval Difference = itemsReceived - itemsProcessed 

[seomaniv]

Thank you, Rich. Wasn't exactly my solution, but your post gave me my solution. What I ended up doing was:

| stats values(*) as *
| eval Difference = itemsReceived - itemsProcessed
| appendcols [stats values(Difference) as Difference by transactionID]

I wouldn't have come to that realization had it not been for your reply. Thank you!