Splunk Search

Loop by field?

    | eval Processed_time=_time
    | streamstats current=false window=500 last(count) as prev_count earliest(Processed_time) as time_of_last_change by namespace 
    | where prev_count != count
    | eval actualchange=prev_count-count 
    | streamstats current=false window=2 range(Processed_time) AS diffoflastchange by namespace
    | eval diffoflastchange=round(diffoflastchange)
    | eval changeformatted=tostring(diffoflastchange,"duration")
    | stats range(diffoflastchange) as totalrange by namespace
    | eval totalrangeformat=tostring(totalrange,"duration")

This query gets me a list of all my namespaces but I don't get the output of totalrange --- the only way I can seem to get the output is if I specify ONE namespace in my base search. So how can I either iterate over all my name spaces OR get this search to work?

0 Karma