earliest=-14d@d latest=-0d@d ns=email msg=send country="United Kingdom" | eval time=strftime(_time,"%H:%M") | chart count by time, msg
In the query above, I'd like to floor the %M by 5 minutes so that sums of every 5 minutes are displayed instead of every minute. Is this possible?
Or maybe even some sort of groupby function that I can apply?
earliest=-14d@d latest=-0d@d ns=email msg=send country="United Kingdom" | eval time=strftime(_time,"%H:%M") | bucket _time span=5m | chart count by _time, msg
earliest=-14d@d latest=-0d@d ns=email msg=send country="United Kingdom" | eval time=strftime(_time,"%H:%M") | bucket _time span=5m | chart count by _time, msg