How about this:
SELECT changes + changes1 + changes2 + changes3 changes28days, login, USEC_TO_TIMESTAMP(week) FROM ( SELECT changes, LAG(changes, 1) OVER (PARTITION BY login ORDER BY week) changes1, LAG(changes, 2) OVER (PARTITION BY login ORDER BY week) changes2, LAG(changes, 3) OVER (PARTITION BY login ORDER BY week) changes3, login, week FROM ( SELECT SUM(payload_pull_request_changed_files) changes, UTC_USEC_TO_WEEK(created_at, 1) week, actor_attributes_login login, FROM [publicdata:samples.github_timeline] WHERE payload_pull_request_changed_files > 0 GROUP BY week, login )) HAVING changes28days > 0
For each user, he counts how many changes they sent per week. Then with LAG () we can look at the next line, how many changes they sent in -1, -2 and -3 weeks. Then we just add these 4 weeks to see how many changes were sent in the last 28 days.
Now you can wrap everything in a new query to filter users with changes> X and read them.
source share