# Apply Prometheus counter rate before aggregating instances

> Summing counters first can conceal the reset behavior needed for an accurate rate.

- Canonical URL: https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:15:40+00:00
- Modified: 2026-10-20T18:34:33+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Summing counters first can conceal the reset behavior needed for an accurate rate.

## Potentially affected

Review PromQL counter rate calculation before aggregate functions are applied.

## DSE recommendation

DSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level.

## Article

Summing counters first can conceal the reset behavior needed for an accurate rate.

## Source facts

Prometheus documents that rate should be applied before aggregation or aggregation-over-time functions. Rate detects counter resets in each input series; aggregating first can prevent that detection when a target restarts. The function is intended for counters rather than arbitrary gauges. Expression order therefore affects the meaning of the resulting operational signal.

Source: [Prometheus documentation — Query functions](https://prometheus.io/docs/prometheus/latest/querying/functions/).

## Applicability

Review PromQL counter rate calculation before aggregate functions are applied.

## DSE recommendation

DSE recommends preserving the original per-instance counter series through rate calculation and aggregating only afterward at the required service level. Review copied dashboard expressions for the order of operations, especially where instances restart independently. Keep metric type and units with the query so a gauge is not accidentally treated as a counter. Choose a window consistent with the scrape interval and the question being answered, and explain the aggregation labels retained in the output.

## Verification

In a test dataset, compare the intended expression with one that aggregates raw counters first while a single instance resets. Inspect the per-instance rate and final aggregate against the known test behavior. Confirm the production query retains the required service boundaries without relying on a superficially similar but semantically different expression. Retain the raw per-instance test samples and reset time with both expression results. Ask the metric owner to explain the observed difference and approve the exact aggregation labels before changing a shared dashboard or recording rule.

## Official reference

[Prometheus documentation — Query functions](https://prometheus.io/docs/prometheus/latest/querying/functions/). Reviewed October 20, 2026.

## Primary reference

- Name: Prometheus documentation — Query functions
- Authority: prometheus.io
- URL: https://prometheus.io/docs/prometheus/latest/querying/functions/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Apply Prometheus counter rate before aggregating instances,” DSE Security, https://update.dsesecurity.com/updates/apply-prometheus-counter-rate-before-aggregating-instances/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.