I think the bin command never really works with the start or end parameter as documented. 😟 For me, I need a simple behavior like this: For a span of 10: 1 = 1-10 2 = 1-10 10 = 1-10 11 = 11-20 19 = 11-20 20 = 11-20 21 = 21-30 So I created a macro called bin2 like this: macro body: eval $data$=$data$-1 | bin span=$span$ $data$ as bucket | eval $data$=$data$+1 | rex field=bucket "^(?<_bin_start>\d+)" | rex field=bucket "\-(?<_bin_end>\d+)$" | eval _bin_start=_bin_start+1 | eval bucket=_bin_start."-"._bin_end | fields - _bin_start, _bin_end marco arguments: data,span And here is an example query: | makeresults count=1 | eval data = "1,5,9,10,11,19,20,25,29" | makemv data delim="," | mvexpand data | `bin2(data, 10)` | table data, bucket And here is the result: data bucket 1 1-10 5 1-10 9 1-10 10 1-10 11 11-20 19 11-20 20 11-20 25 21-30 29 21-30
... View more