BASE SEARCH
...
| eval Processed_time=_time
| streamstats current=false window=500 last(count) as prev_count earliest(Processed_time) as time_of_last_change by namespace
| where prev_count != count
| eval actualchange=prev_count-count
| streamstats current=false window=2 range(Processed_time) AS diffoflastchange by namespace
| eval diffoflastchange=round(diffoflastchange)
| eval changeformatted=tostring(diffoflastchange,"duration")
| stats range(diffoflastchange) as totalrange by namespace
| eval totalrangeformat=tostring(totalrange,"duration")
This query gets me a list of all my namespaces but I don't get the output of totalrange --- the only way I can seem to get the output is if I specify ONE namespace in my base search. So how can I either iterate over all my name spaces OR get this search to work?
