It's tough using the relative time operations for earliest and latest to round to something larger than a minute, but smaller than an hour. If I understand your request correctly, you'd like to be able to do something like latest=h/15m@m or latest=h/5m@m to say "Give me the current hour, rounded to the most recent 5/15 minute interval in said hour, rounded to the minute."
I may have entirely misunderstood what you were looking for. But, if I didn't here is an UGLY way of getting there using a subsearch:
[ search earliest=@h latest=@h+1m
| head 1 | addinfo
| eval td=(floor((now()-info_min_time)/900)*900)+info_min_time
| rename td as latest | fields latest
]
Put that in your original search and it will, using the subsearch, evaluate out latest to the time_t (seconds since 1/1/1970 00:00:00 GMT) of the end of the most recent 15-minute interval in the current hour.
I'm not sure whether to be proud of this or not 🙂
... View more