Basically, if you want your minute spans to start at x=25 seconds after the minute, use something like this... | eval _time = _time -25 | bucket _time span=1m | eval _time = _time +25 Now that you understand, here's the efficient way, since it's streaming distributable. | eval _time = 25+60*floor( (_time-25)/60) ... and if you want the low end to start exactly at the low end of your search time, then use addinfo and calculate it this way | addinfo | eval mysecond = floor(info_min_time) - 60*floor(info_min_time/60) | eval _time = mysecond+60*floor( (_time-mysecond)/60) ...or possibly... | addinfo | eval _time = floor(info_min_time) + 60*floor((_time - info_min_time)/60) Those two will give fractionally different results, but the second one should be slightly quicker, I would think. ... View more