Can you help me compare the numerical values of fields?

[sgoodman26]

My company gets a log file that we are trying to compare a set of numbers to one another. These numbers have to be within ten digits of one another, otherwise we need to be alerted on this. I've been able to Extract both of these numbers into fields (last_applied and last_received), and I am trying to run a search that compares the two, but ONLY alerts when they are over 10 digits away form each other. Been trying to use the diff function, but am a bit stuck on which eval or other functions that would be appropriate.

This is what I have so far:

index="mail" host="outlook.office365.com" last_applied=* last_received=* | diff attribute=last_applied attribute=last_received

Any help would be greatly appreciated.

[woodcock]

Like this:

index="mail" host="outlook.office365.com" last_applied=* last_received=*
| where abs(last_applied - last_received) >= 10

[somesoni2]

Are you looking for something like this?
*Updated *

    index="mail" host="outlook.office365.com" last_applied=* last_received=* | eval diff=abs(last_applied-last_received)
| where diff>10

[HiroshiSatoh]

I do not know "over 10 digits". Can you write an example?

[sgoodman26]

If Last Applied = 3100 and Last Received =3110, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 2990, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 3111, this would be outside of 10 of each other.