Hello
I have events that include a field of username ( and of course _time) .I would like to count how many users were added each month, but there are times with no new users were created.
I can find the first appearance of each user using
Stats min(_time) by username
And then I can use timechart to count new users by month and streamstats to get the cumulative sum.
I have found how to fill the gaps if there were no new users during a month m by using the makecontinues command. what i didn't figure yet is how to fill the period before the first user creation and since the last time a user was created , until today .
...
| timechart span=1mon count(username) as users
| makecontinues spam=1mon _time
| fillnull
| streamstats sum(users) as com
thanks for the help
Timechart already fills the gaps including before and after based on the time range from the timepicker / earliest and latest, so you should just be able to use streamstats after timechart.
...
| timechart span=1mon count(username) as users
| streamstats sum(users) as com