I have 3 main fields: time, totalvehicle, and changes. total_vehicle is only generate periodically and I would like to find out what is happening in between with the "changes" field. Just plainly putting them in table I get:
You should be able to use accum command to achieve what you need.
If you are using timechart command to aggregate vehicle_count using min(), you can use as to provide it a simple alias to be reused further down the query for example.
| timechart min(vehicle_count) as vehicle_count
| accum vehicle_count as vehicle_count
If you wish to retain existing fields you can provide a new name after as.