Generally (not the complete solution but you can iterate it out) like this:
... | eventstats latest(y) AS lastyBYfoo BY foo | stats first(lastyBYfoo) AS lastyBYfoo earliest(x) AS firstxBYfoobar earliest(y) AS firstyBYfoobar latest(x) AS lastxBYfoobar latest(y) AS lastyBYfoobar by foo bar | eval monthly1=if(foo=1 AND bar=10,firstxBYfoobar + lastyBYfoobar + lastxBYfoobar ,0) + if(foo=1 AND bar=11,lastxBYfoobar+lastyBYfoobar,0) + ... + if(foo=1,lastyBYfoo,0)
I would save everything after | monthly1 as a macro and call it like this:
... | eventstats earliest(x) AS firstxBYfoobar earliest(y) AS firstyBYfoobar latest(x) AS lastxBYfoobar latest(y) AS lastyBYfoobar by foo bar | eventstats latest(y) AS lastyBYfoo | dedup foo bar | `monthly(1)` | `monthly(2)` ...
... View more