| sort 0 id _time
| streamstats current=f timewindow=30s count as idcount by id
| eval newgroup=case(isnull(idcount),1,idcount=0,1,true(),0)
| streamstats sum(newgroup) as groupno by id
| eventstats count as groupcount by id groupno
The above counts records for an id all as the same group if each is within 30s of the prior one. The minute that there is no prior record for the same id within 30s previously, it counts as a new group, so a group might have one record in it.