Grouping events from bin command to adhere to the lookback time window?

[justanothersplu]

I'm running a search coming back with the following logic, the idea here is there I have a bunch of events but I want to use the bin command want span=60m to actually be respective to the time I'm searching ( from 9:27 PM to 10:27PM), instead of snapping to the hour. 
Similar to how when we do earliest=-1h@h, that snaps to the hour and earliest=-60m@m, snaps to the minute, is there a way I can have the bin command snap to the minute and not the hour?

[danspav]

Hi @justanothersplu,

I think Bin has just the feature you're looking for: aligntime

You can pass aligntime the following:

• earliest - snap to the earliest time (down to the second), and let everything bin off that
• latest - similarly, snap to the latest time
• <time-specifier> This is what you'll need: set it to @m to snap to the current time to the minute

See docs: Bin

Try running this:

index=_internal
| bin _time span=60m  aligntime=@m

All the bins will snap to the current minute, and go back in 60m increments.

Note - this won't work if you set your search time range to end some time in the past, but will work if you only want to snap to the current clock time.

To be able to get buckets to snap to the minute based on your search time and not the clock time, you could try something monstrous like:

index=_internal
| bin _time span=60m [ | makeresults | addinfo | eval aligntime=strptime(strftime(info_max_time,"%Y-%m-%d %H:%M:00"),"%Y-%m-%d %H:%M:%S") | table aligntime | return aligntime ]

I don't recommend it, but this search will calculate the latest search time to the minute, and use it to add to the bin command. 

I think the first option will suit your needs best.

cheers,
Daniel