The reporting team wants «event counts per month plus a «total for the period» row». A classic case of enriching a grouping with an interim total. Group events by their creation month and simultaneously compute the «grand total» level — the last row of the output should have an empty month and the overall event count across every month. Sort by month, with the empty-month total row going last.