Add `total` column for aggregate event counts

This probably implies that aggregate event counts should
be a separate endpoint.