My company gets a log file that we are trying to compare a set of numbers to one another. These numbers have to be within ten digits of one another, otherwise we need to be alerted on this. I've been able to Extract both of these numbers into fields (last_applied and last_received), and I am trying to run a search that compares the two, but ONLY alerts when they are over 10 digits away form each other. Been trying to use the diff
function, but am a bit stuck on which eval
or other functions that would be appropriate.
This is what I have so far:
index="mail" host="outlook.office365.com" last_applied=* last_received=* | diff attribute=last_applied attribute=last_received
Any help would be greatly appreciated.
Like this:
index="mail" host="outlook.office365.com" last_applied=* last_received=*
| where abs(last_applied - last_received) >= 10
Are you looking for something like this?
*Updated *
index="mail" host="outlook.office365.com" last_applied=* last_received=* | eval diff=abs(last_applied-last_received)
| where diff>10
I do not know "over 10 digits". Can you write an example?
If Last Applied = 3100 and Last Received =3110, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 2990, this would be within 10 of each other.
If Last Applied = 3100 and Last Received = 3111, this would be outside of 10 of each other.