I'm currently using | bucket _time span=1d,  it helps get the results by day for the SCORE that I'm looking for. Apologies for the confusion. I'll try and break it down. If the scores are  DAY0 = 10 DAY1 = 100 DAY2 = 1000 The trend evals are looking for:  Is the score for DAY1 5% greater than DAY0, if so the value for DAY1 is 1, otherwise 0 Is the score for DAY2 10% greater than DAY0, if so the value for DAY2 is 1, otherwise 0 If the sum of DAY1+DAY2 is greater than 0 then THRESHBREAK=TRUE. I hope that helps clarify.  What it seems like is that the search for the scores within the time frame specified isn't finding it accurately and I'm unsure why. ... View more