[therealdrag0]

For splunk you can set unit by setting span like this | timechart span=30s count by X