combining delta/where searches

[tedder]

These searches: index=foo | delta a as a_delta | where a_delta < 0 index=foo | delta b as b_delta | where b_delta < 0 index=foo | delta c as c_delta | where c_delta < 0 index=foo | delta d as d_delta | where d_delta < 0

I'm combining them like the following:

index=foo | delta a as a_delta | delta b as b_delta | delta c as c_delta | delta d as d_delta | where a_delta < 0 OR b_delta < 0 OR c_delta < 0 OR d_delta < 0

Is there an easier way to do this?

Note a,b,c,d have different values; they can't and shouldn't be compared against each other.

As a bonus, it would be nice to identify which of the fields doesn't match. My combination only shows that they don't match, not that it is field "c" that is the culprit.

[lguinn2]

I assume that you want to trigger an alert if you get a negative delta for any of the fields. But I'm not clear on why you need to combine the searches.

If the search is slow because there is a lot of data, I suggest that you run it more often. For example, if it is running every hour, run it every 15 minutes instead. Also, is there any way that you could further restrict this search, instead of just searching index=foo? Do the fields a, b, c and d appear in every event in the foo index?

If you run 4 searches instead of a single search, you will be able to set your alert text to easily see which field has gone wacky.

Please correct me if I don't understand the issue,