`.es(index="metricbeat-*",q="beat.hostname:srvwin01", metric="max:system.network.in.bytes", kibana=true,split=system.network.name:64).fit(scale).scale_interval(1s).derivative().if(lt,0,0).divide(1048576).lines(fill=2, width=1).multiply(8).trim(start=1,end=1).label(regex='.* system.network.name:(.*) >.*', label="Inbound $1")`

Above is the query I'm using to report on metricbeat data to determine bandwidth utilization, but since the Windows byte counter resets after it hits 4GB, I had to add the "if(lt,0,0)" to zero out the derivative anytime it goes negative. What I'd *rather* do is some form of addition to try and compensate anytime the derivative goes negative, but I don't know how to reference the *current* value in the dataset that the if statement is working on. (i.e. if the value is -278987942, then return -278987942 plus 4000000000 (and yes I'm aware that math isn't accurate..just needed an example))