You cannot combine detectors like this. However, you can create a scripted field that calculates the difference on the fly (and name that field delta
for example) and then use ML (i.e. max(delta)
) on that new field
Example: ML Job on Scripted field