I think you'll need something like the following
<base search>
| stats latest(mileStoneId) as mileStoneId, latest(_time) as _time by pddID
| eval stash_interval=now()-_time
| eval interval_bucket=case(stash_interval<60,"< 1min", stash_interval<180,"1-3min", stash_interval<300,"3-5min",1==1,">5mins")`
| stats count by interval_bucket, mileStoneId
First, get all the data you need as part of your base search. Then get the latest mileStoneID and _time for each pddID.
Assuming that the _time of the event is correct, you could calculate the how long it has been in that state by doing eval stash_interval=now()-_time .
Next, you can calculate what interval "bucket" you want to put it in, with eval interval_bucket=case(stash_interval<60,"< 1min", stash_interval<180,"1-3min", stash_interval<300,"3-5min",1==1,">5mins")
Once you have that data, you can do a stats count by mileStoneId, interval bucket , and you should end up with the table you are after.
Good luck!
... View more