I talked with @LeeDr a bit about this and it seems like the closest you can get to what you're looking for is a Terms bucket aggregation on your "src" field, and then a Range sub-aggregation on the "duration" field for the different ranges you're interested in.