The original post was very close, but was often giving me too few buckets.
For example, with 15s starting at time 2s, I want 4 buckets: [2,5), [5,10), [10,15), [15-17). The code as written gave me 3.
For my 1 minute buckets, the addition below resolved the problem.
| eval bucket_start=mvrange(relative_time(start_time, "-0m@m"),end_time,60)
... View more