Sql of note
From Federal Burro of Information
Example of Time bucket
select from_unixtime(timestamp-timestamp%3600)as time, count(*) from table where data like 'Destination directory %does not exist at%' and FROM_UNIXTIME(timestamp) > subdate(now(),interval 4 day) group by timestamp-timestamp%3600 order by time;