cumulative sum

[avishni01]

Hello

I have events that include a field of username ( and of course _time) .I would like to count how many users were added each month, but there are times with no new users were created. 

I can find the first appearance of each user using

Stats min(_time) by username

And then I can use timechart to count new users by month and streamstats to get the cumulative sum.

I have found how to fill the gaps if there were no new users during a month m by using the makecontinues command. what i didn't figure yet is how to fill the period before the first user creation and since the last time a user was created , until today .

... 
| timechart span=1mon count(username) as users
| makecontinues  spam=1mon _time
| fillnull
| streamstats sum(users)  as com

thanks for the help

[ITWhisperer]

Timechart already fills the gaps including before and after based on the time range from the timepicker / earliest and latest, so you should just be able to use streamstats after timechart.

... 
| timechart span=1mon count(username) as users
| streamstats sum(users)  as com