There are several solutions. 1) You could add at the end, either before or after timechart | rename COMMENT as "Move all _times five minutes later" | eval _time = _time +300 2) Before the timechart, you could do this | rename COMMENT as "Move all _times to end of period" | eval _time = 300* ceiling(_time/300) 3) or this | rename COMMENT as "Move all _times to end of period" | eval _time = _time + 299.999 The difference in result between the three is whether you want events that occur at exactly 3:05 to show up at 3:05 or 3:10. The first will move them to 3:10, whereas the second and third will leave them at 3:05. ... View more