How to calculate the total in a time range based on it own time stamp?

[suntianze]

I want a table that looks like this. Where the first column UserID is the identity. The second column is the earliest timestamp when the ID appears. The sum of the viewing time of the third column relative to the 3 days after the ID appeared. I don't know how to set the time range, because the time is three days after the earliest time stamp. And it is different for each ID.

[to4kawa]

index=yours event_extra_userInfo_userId=* 
| bin _time span=1d
| stats earliest(timesatmp) as first_appear count as day_count by _time event_extra_userInfo_userId
| eventstats min(first_appear) as firstTime by event_extra_userInfo_userId
| eventstats sum(eval(if(_time <= relative_time(firstTime,"+3d@d") , day_count, NULL))) as total by event_extra_userInfo_userId

Where the first column UserID is the identity
There is not UserID in your sample pic.