When we started using Splunk a couple of years ago, we needed to calculate mean on various time windows (5, 20, 60) minutes.
The _time variable after the bucket (bin) operation would be the ending time of the time slot for each new row:
bucket times accordingly:
00:00:001 through 00:05:00 ---> bucket 00:05
00:05:001 through 00:10:00 ---> bucket 00:10
search .... | bin _time minspan=5m | ...
So 10:06, 10:07, 10:08 would all be in the 10:10 bucket. When I ran it today (6.5.2), The new _time value was for the previous time slot 10:05. This makes no sense to me. Why label events that occurred after time for that time? I experimented with hours and found the same thing. However when I upped it to days (span=1d), it used the correct current day.
Is there a way to tell it to bucket the times on the ending value instead of the starting value?