Flooring the minutes of a strftime eval

[metersk]

earliest=-14d@d latest=-0d@d ns=email msg=send country="United Kingdom" | eval time=strftime(_time,"%H:%M") | chart count by time, msg

In the query above, I'd like to floor the %M by 5 minutes so that sums of every 5 minutes are displayed instead of every minute. Is this possible?

Or maybe even some sort of groupby function that I can apply?

[masonmorales · Accepted solution]

 earliest=-14d@d latest=-0d@d ns=email msg=send country="United Kingdom" | eval time=strftime(_time,"%H:%M") | bucket _time span=5m | chart count by _time, msg