Only execute if greater than or equal to x mins

[hl]

Hello looking for way to create an alert based off the difference between times and only execute if the time is greater than or equal to x mins. 

Code: 

index=net* sourcetype=pan:* 
action="blocked" OR action="failure"
|stats count min(_time) as firstTime 
max(_time) as lastTime
by src_ip,dest,dest_port,rule,tag,log_subtype,transport |where count >= 10 
|eval diff=lastTime-firstTime
```|eval diff=strftime(diff, "%d %H:%M:%S") ```
|eval diff=strftime(diff, "%M:%S") 
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`

 Regards, 

[hl]

Actually I think I figured this out!

index=netfw sourcetype=pan:* 
action="blocked" OR action="failure"
|stats count min(_time) as firstTime max(_time) as lastTime by src_ip |where count >= 10
|eval diff=floor((lastTime-firstTime)) 
|eval "Difference in Mins" = floor((diff / 60)) 
|eval SortbyMins="Difference in Mins"
|fields - diff,SortbyMins
|sort - SortbyMins

| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`

[hl]

Created this instead, 

index=net* sourcetype=pan:* 
action="blocked" OR action="failure"
|stats count min(_time) as firstTime max(_time) as lastTime by src_ip |where count >= 10
|eval diff=toString(lastTime-firstTime, "duration")
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`

 but still trying to figure out how to only show results if greater than x mins. ?  

[hl]

I just wanna make variable and assign it but I know I can't do that and you can't create boolean on an eval