diff --git a/.changeset/gorgeous-parrots-tie.md b/.changeset/gorgeous-parrots-tie.md
new file mode 100644
index 0000000000..a94370c465
--- /dev/null
+++ b/.changeset/gorgeous-parrots-tie.md
@@ -0,0 +1,6 @@
+---
+"@hyperdx/api": minor
+"@hyperdx/app": minor
+---
+
+Add support for increase aggFn on sum counter metrics and rewrite sum metric rate computation to fix correctness issues.
diff --git a/packages/api/src/clickhouse/__tests__/renderChartConfig.test.ts b/packages/api/src/clickhouse/__tests__/renderChartConfig.test.ts
index 3b1bbcaddc..7ea8a36442 100644
--- a/packages/api/src/clickhouse/__tests__/renderChartConfig.test.ts
+++ b/packages/api/src/clickhouse/__tests__/renderChartConfig.test.ts
@@ -789,6 +789,89 @@ describe('renderChartConfig', () => {
       );
       expect(await queryData(maxQuery)).toMatchSnapshot('maxSum');
     });
+
+    it('new series appearing mid-window: v2 suppresses first-row spike', async () => {
+      // Scenario: An existing series (customerA) has data from the start,
+      // and a new series (customerB) appears mid-window with a high
+      // cumulative counter value (e.g. 10000). A naive inter-bucket diff
+      // approach would leak the full cumulative value as a spike on the
+      // first bucket of customerB. The v2 lagInFrame-based Rate yields 0
+      // for the first row of each series, preventing the spike.
+
+      // Use a unique metric name to isolate from the beforeEach data.
+      const metricName = 'customer.events.total';
+
+      // customerA: present from the start, steady increase
+      const customerAPoints = [
+        { value: 0, timestamp: now - ms('1m') },
+        { value: 10, timestamp: now + ms('2m') },
+        { value: 20, timestamp: now + ms('7m') },
+        { value: 30, timestamp: now + ms('12m') },
+        { value: 40, timestamp: now + ms('17m') },
+      ].map(point => ({
+        MetricName: metricName,
+        ServiceName: 'api',
+        ResourceAttributes: { customer: 'customerA' },
+        Value: point.value,
+        TimeUnix: new Date(point.timestamp),
+        IsMonotonic: true,
+        AggregationTemporality: 2, // Cumulative
+      }));
+
+      // customerB: appears at +10m with a high cumulative value (10000),
+      // then increases to 10050 by +17m. The real per-bucket increase is
+      // only 50. A naive approach would show 10000 in the bucket where it
+      // first appears.
+      const customerBPoints = [
+        { value: 10000, timestamp: now + ms('10m') },
+        { value: 10020, timestamp: now + ms('12m') },
+        { value: 10050, timestamp: now + ms('17m') },
+      ].map(point => ({
+        MetricName: metricName,
+        ServiceName: 'api',
+        ResourceAttributes: { customer: 'customerB' },
+        Value: point.value,
+        TimeUnix: new Date(point.timestamp),
+        IsMonotonic: true,
+        AggregationTemporality: 2, // Cumulative
+      }));
+
+      await bulkInsertMetricsSum([...customerAPoints, ...customerBPoints]);
+
+      // --- v2 query (current code with lagInFrame) ---
+      const v2Query = await renderChartConfig(
+        {
+          select: [
+            {
+              aggFn: 'sum',
+              metricName: metricName,
+              metricType: MetricsDataType.Sum,
+              valueExpression: 'Value',
+            },
+          ],
+          from: metricSource.from,
+          where: '',
+          metricTables: TEST_METRIC_TABLES,
+          dateRange: [new Date(now), new Date(now + ms('20m'))],
+          granularity: '5 minute',
+          timestampValueExpression: metricSource.timestampValueExpression,
+          connection: connection.id,
+        },
+        metadata,
+        querySettings,
+      );
+      const v2Results = await queryData(v2Query);
+
+      // v2 should NOT have a spike — the max bucket value should be much
+      // smaller than customerB's initial cumulative value (10000). The real
+      // per-bucket increases across both series are at most ~50.
+      const v2Values = v2Results.map((r: any) => Number(r.Value));
+      const v2MaxValue = Math.max(...v2Values);
+      expect(v2MaxValue).toBeLessThan(100);
+
+      // Verify we actually got data back (not an empty result set).
+      expect(v2Results.length).toBeGreaterThan(0);
+    });
   });
 
   describe('Query Metrics - Histogram', () => {
diff --git a/packages/app/src/ChartUtils.tsx b/packages/app/src/ChartUtils.tsx
index 41adc8ae5f..544c6762d5 100644
--- a/packages/app/src/ChartUtils.tsx
+++ b/packages/app/src/ChartUtils.tsx
@@ -60,6 +60,7 @@ export const AGG_FNS = [
     isAttributable: false,
   },
   { value: 'any' as const, label: 'Any' },
+  { value: 'increase' as const, label: 'Increase', isAttributable: false },
   { value: 'none' as const, label: 'Custom' },
 ];
 
diff --git a/packages/app/src/components/AggFnSelect.tsx b/packages/app/src/components/AggFnSelect.tsx
index b7a9c97bfe..66e1a2e5ae 100644
--- a/packages/app/src/components/AggFnSelect.tsx
+++ b/packages/app/src/components/AggFnSelect.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useMemo } from 'react';
 import { useController, UseControllerProps } from 'react-hook-form';
+import { MetricsDataType } from '@hyperdx/common-utils/dist/types';
 import { Select } from '@mantine/core';
 
 import { AGG_FNS } from '@/ChartUtils';
@@ -14,11 +15,13 @@ function AggFnSelect({
   defaultValue,
   onChange,
   hideCustom,
+  metricType,
 }: {
   value: string;
   defaultValue: string;
   onChange: (value: OnChangeValue) => void;
   hideCustom?: boolean;
+  metricType?: MetricsDataType;
 }) {
   const _onChange = useCallback(
     (value: string | null) => {
@@ -37,6 +40,15 @@ function AggFnSelect({
     [onChange],
   );
 
+  const options = useMemo(() => {
+    let opts = hideCustom ? AGG_FNS.filter(fn => fn.value !== 'none') : AGG_FNS;
+    // Only show 'increase' when the source is a Sum (counter) metric.
+    if (metricType !== MetricsDataType.Sum) {
+      opts = opts.filter(fn => fn.value !== 'increase');
+    }
+    return opts;
+  }, [hideCustom, metricType]);
+
   return (
     <Select
       withScrollArea={false}
@@ -44,7 +56,7 @@ function AggFnSelect({
       value={value}
       defaultValue={defaultValue}
       onChange={_onChange}
-      data={hideCustom ? AGG_FNS.filter(fn => fn.value !== 'none') : AGG_FNS}
+      data={options}
       data-testid="agg-fn-select"
     />
   );
@@ -55,12 +67,14 @@ export function AggFnSelectControlled({
   quantileLevelName,
   defaultValue,
   hideCustom,
+  metricType,
   ...props
 }: {
   defaultValue: string;
   aggFnName: string;
   quantileLevelName: string;
   hideCustom?: boolean;
+  metricType?: MetricsDataType;
 } & Omit<UseControllerProps<any>, 'name'>) {
   const {
     field: { onChange: onAggFnChange, value: aggFnValue },
@@ -101,6 +115,7 @@ export function AggFnSelectControlled({
       defaultValue={defaultValue}
       onChange={onChange}
       hideCustom={hideCustom}
+      metricType={metricType}
     />
   );
 }
diff --git a/packages/app/src/components/DBEditTimeChartForm/ChartSeriesEditor.tsx b/packages/app/src/components/DBEditTimeChartForm/ChartSeriesEditor.tsx
index 52859c1a5b..7ed206e8b1 100644
--- a/packages/app/src/components/DBEditTimeChartForm/ChartSeriesEditor.tsx
+++ b/packages/app/src/components/DBEditTimeChartForm/ChartSeriesEditor.tsx
@@ -114,6 +114,18 @@ export function ChartSeriesEditor({
     }
   }, [tableSource?.kind, metricType, aggFn, namePrefix, setValue]);
 
+  // 'increase' aggFn is only valid on Sum metrics. Reset it if the user
+  // switches to a different metric type or source kind so the backend does
+  // not error on a stale 'increase' selection.
+  useEffect(() => {
+    const isSumMetric =
+      tableSource?.kind === SourceKind.Metric &&
+      metricType === MetricsDataType.Sum;
+    if (!isSumMetric && aggFn === 'increase') {
+      setValue(`${namePrefix}aggFn`, 'sum');
+    }
+  }, [tableSource?.kind, metricType, aggFn, namePrefix, setValue]);
+
   const tableName =
     tableSource?.kind === SourceKind.Metric
       ? getMetricTableName(tableSource, metricType)
@@ -273,6 +285,9 @@ export function ChartSeriesEditor({
             defaultValue={AGG_FNS[0]?.value ?? 'avg'}
             control={control}
             hideCustom={tableSource?.kind === SourceKind.Metric}
+            metricType={
+              tableSource?.kind === SourceKind.Metric ? metricType : undefined
+            }
           />
         </div>
         {tableSource?.kind === SourceKind.Metric && metricType && (
diff --git a/packages/common-utils/src/__tests__/__snapshots__/renderChartConfig.test.ts.snap b/packages/common-utils/src/__tests__/__snapshots__/renderChartConfig.test.ts.snap
index e4cde7d55b..e97e977c7b 100644
--- a/packages/common-utils/src/__tests__/__snapshots__/renderChartConfig.test.ts.snap
+++ b/packages/common-utils/src/__tests__/__snapshots__/renderChartConfig.test.ts.snap
@@ -550,42 +550,71 @@ exports[`renderChartConfig k8s semantic convention migrations should generate SQ
                 SELECT
                   *,
                   cityHash64(mapConcat(ScopeAttributes, ResourceAttributes, Attributes)) AS AttributesHash,
-                  IF(AggregationTemporality = 1,
-                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY AttributesHash, TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
-                    IF(IsMonotonic = 0, 
-                      Value,
-                      deltaSum(Value) OVER (PARTITION BY AttributesHash ORDER BY AttributesHash, TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW)
-                    )
+                  IF(
+                    AggregationTemporality = 1,
+                    Value, -- DELTA: Value is already the per-interval increase
+                    greatest(Value - lagInFrame(toNullable(Value), 1, NULL) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix), 0)
                   ) AS Rate,
-                  IF(AggregationTemporality = 1, Rate, Value) AS Sum
+                  IF(
+                    AggregationTemporality = 1,
+                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
+                    Value
+                  ) AS Sum
                 FROM default.otel_metrics_sum
                 WHERE (TimeUnix >= toStartOfInterval(fromUnixTimestamp64Milli(1739318400000), INTERVAL 5 minute) - INTERVAL 5 minute AND TimeUnix <= toStartOfInterval(fromUnixTimestamp64Milli(1765670400000), INTERVAL 5 minute) + INTERVAL 5 minute) AND ((MetricName IN ('k8s.node.cpu.utilization', 'k8s.node.cpu.usage')))),Bucketed AS (
             SELECT
-              toStartOfInterval(toDateTime(TimeUnix), INTERVAL 5 minute) AS \`__hdx_time_bucket2\`,
+              \`__hdx_time_bucket2\`,
               AttributesHash,
-              last_value(Source.Rate) AS \`__hdx_value_high\`,
-              any(\`__hdx_value_high\`) OVER(PARTITION BY AttributesHash ORDER BY \`__hdx_time_bucket2\` ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING) AS \`__hdx_value_high_prev\`,
-              IF(IsMonotonic = 1, \`__hdx_value_high\` - \`__hdx_value_high_prev\`, \`__hdx_value_high\`) AS Rate,
-              last_value(Source.Sum) AS Sum,
-              any(ResourceAttributes) AS ResourceAttributes,
-              any(ResourceSchemaUrl) AS ResourceSchemaUrl,
-              any(ScopeName) AS ScopeName,
-              any(ScopeVersion) AS ScopeVersion,
-              any(ScopeAttributes) AS ScopeAttributes,
-              any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
-              any(ScopeSchemaUrl) AS ScopeSchemaUrl,
-              any(ServiceName) AS ServiceName,
-              any(MetricName) AS MetricName,
-              any(MetricDescription) AS MetricDescription,
-              any(MetricUnit) AS MetricUnit,
-              any(Attributes) AS Attributes,
-              any(StartTimeUnix) AS StartTimeUnix,
-              any(Flags) AS Flags,
-              any(AggregationTemporality) AS AggregationTemporality,
-              any(IsMonotonic) AS IsMonotonic
-            FROM Source
-            GROUP BY AttributesHash, \`__hdx_time_bucket2\`
-            ORDER BY AttributesHash, \`__hdx_time_bucket2\`
+              Rate,
+              Sum,
+              ResourceAttributes,
+              ResourceSchemaUrl,
+              ScopeName,
+              ScopeVersion,
+              ScopeAttributes,
+              ScopeDroppedAttrCount,
+              ScopeSchemaUrl,
+              ServiceName,
+              MetricName,
+              MetricDescription,
+              MetricUnit,
+              Attributes,
+              StartTimeUnix,
+              Flags,
+              AggregationTemporality,
+              IsMonotonic
+            FROM (
+              SELECT
+                toStartOfInterval(toDateTime(TimeUnix), INTERVAL 5 minute) AS \`__hdx_time_bucket2\`,
+                AttributesHash,
+                -- Per-bucket increase: sum of raw per-row deltas. NULL
+                -- Source.Rate (first row of each partition) is ignored by sum().
+                sum(Source.Rate) AS Rate,
+                -- Last cumulative reading in the bucket (by time), used by
+                -- the no-aggFn last_value(Sum) outer projection. argMax is
+                -- deterministic w.r.t. TimeUnix ordering unlike last_value
+                -- which in a GROUP BY context is anyLast (order-dependent).
+                argMax(Source.Sum, TimeUnix) AS Sum,
+                any(ResourceAttributes) AS ResourceAttributes,
+                any(ResourceSchemaUrl) AS ResourceSchemaUrl,
+                any(ScopeName) AS ScopeName,
+                any(ScopeVersion) AS ScopeVersion,
+                any(ScopeAttributes) AS ScopeAttributes,
+                any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
+                any(ScopeSchemaUrl) AS ScopeSchemaUrl,
+                any(ServiceName) AS ServiceName,
+                any(MetricName) AS MetricName,
+                any(MetricDescription) AS MetricDescription,
+                any(MetricUnit) AS MetricUnit,
+                any(Attributes) AS Attributes,
+                any(StartTimeUnix) AS StartTimeUnix,
+                any(Flags) AS Flags,
+                any(AggregationTemporality) AS AggregationTemporality,
+                any(IsMonotonic) AS IsMonotonic
+              FROM Source
+              GROUP BY AttributesHash, \`__hdx_time_bucket2\`
+              ORDER BY AttributesHash, \`__hdx_time_bucket2\`
+            )
           ) SELECT max(
       toFloat64OrDefault(toString(Rate))
     ) AS "Value",toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` FROM Bucketed WHERE (\`__hdx_time_bucket2\` >= fromUnixTimestamp64Milli(1739318400000) AND \`__hdx_time_bucket2\` <= fromUnixTimestamp64Milli(1765670400000)) GROUP BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` ORDER BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` LIMIT 10 SETTINGS optimize_read_in_order = 0, cast_keep_nullable = 1, additional_result_filter = 'x != 2', count_distinct_implementation = 'uniqCombined64', async_insert_busy_timeout_min_ms = 20000"
@@ -760,45 +789,237 @@ exports[`renderChartConfig should generate sql for a single sum metric 1`] = `
                 SELECT
                   *,
                   cityHash64(mapConcat(ScopeAttributes, ResourceAttributes, Attributes)) AS AttributesHash,
-                  IF(AggregationTemporality = 1,
-                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY AttributesHash, TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
-                    IF(IsMonotonic = 0, 
-                      Value,
-                      deltaSum(Value) OVER (PARTITION BY AttributesHash ORDER BY AttributesHash, TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW)
-                    )
+                  IF(
+                    AggregationTemporality = 1,
+                    Value, -- DELTA: Value is already the per-interval increase
+                    greatest(Value - lagInFrame(toNullable(Value), 1, NULL) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix), 0)
                   ) AS Rate,
-                  IF(AggregationTemporality = 1, Rate, Value) AS Sum
+                  IF(
+                    AggregationTemporality = 1,
+                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
+                    Value
+                  ) AS Sum
                 FROM default.otel_metrics_sum
                 WHERE (TimeUnix >= toStartOfInterval(fromUnixTimestamp64Milli(1739318400000), INTERVAL 5 minute) - INTERVAL 5 minute AND TimeUnix <= toStartOfInterval(fromUnixTimestamp64Milli(1765670400000), INTERVAL 5 minute) + INTERVAL 5 minute) AND ((MetricName = 'db.client.connections.usage'))),Bucketed AS (
             SELECT
-              toStartOfInterval(toDateTime(TimeUnix), INTERVAL 5 minute) AS \`__hdx_time_bucket2\`,
+              \`__hdx_time_bucket2\`,
               AttributesHash,
-              last_value(Source.Rate) AS \`__hdx_value_high\`,
-              any(\`__hdx_value_high\`) OVER(PARTITION BY AttributesHash ORDER BY \`__hdx_time_bucket2\` ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING) AS \`__hdx_value_high_prev\`,
-              IF(IsMonotonic = 1, \`__hdx_value_high\` - \`__hdx_value_high_prev\`, \`__hdx_value_high\`) AS Rate,
-              last_value(Source.Sum) AS Sum,
-              any(ResourceAttributes) AS ResourceAttributes,
-              any(ResourceSchemaUrl) AS ResourceSchemaUrl,
-              any(ScopeName) AS ScopeName,
-              any(ScopeVersion) AS ScopeVersion,
-              any(ScopeAttributes) AS ScopeAttributes,
-              any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
-              any(ScopeSchemaUrl) AS ScopeSchemaUrl,
-              any(ServiceName) AS ServiceName,
-              any(MetricName) AS MetricName,
-              any(MetricDescription) AS MetricDescription,
-              any(MetricUnit) AS MetricUnit,
-              any(Attributes) AS Attributes,
-              any(StartTimeUnix) AS StartTimeUnix,
-              any(Flags) AS Flags,
-              any(AggregationTemporality) AS AggregationTemporality,
-              any(IsMonotonic) AS IsMonotonic
-            FROM Source
-            GROUP BY AttributesHash, \`__hdx_time_bucket2\`
-            ORDER BY AttributesHash, \`__hdx_time_bucket2\`
+              Rate,
+              Sum,
+              ResourceAttributes,
+              ResourceSchemaUrl,
+              ScopeName,
+              ScopeVersion,
+              ScopeAttributes,
+              ScopeDroppedAttrCount,
+              ScopeSchemaUrl,
+              ServiceName,
+              MetricName,
+              MetricDescription,
+              MetricUnit,
+              Attributes,
+              StartTimeUnix,
+              Flags,
+              AggregationTemporality,
+              IsMonotonic
+            FROM (
+              SELECT
+                toStartOfInterval(toDateTime(TimeUnix), INTERVAL 5 minute) AS \`__hdx_time_bucket2\`,
+                AttributesHash,
+                -- Per-bucket increase: sum of raw per-row deltas. NULL
+                -- Source.Rate (first row of each partition) is ignored by sum().
+                sum(Source.Rate) AS Rate,
+                -- Last cumulative reading in the bucket (by time), used by
+                -- the no-aggFn last_value(Sum) outer projection. argMax is
+                -- deterministic w.r.t. TimeUnix ordering unlike last_value
+                -- which in a GROUP BY context is anyLast (order-dependent).
+                argMax(Source.Sum, TimeUnix) AS Sum,
+                any(ResourceAttributes) AS ResourceAttributes,
+                any(ResourceSchemaUrl) AS ResourceSchemaUrl,
+                any(ScopeName) AS ScopeName,
+                any(ScopeVersion) AS ScopeVersion,
+                any(ScopeAttributes) AS ScopeAttributes,
+                any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
+                any(ScopeSchemaUrl) AS ScopeSchemaUrl,
+                any(ServiceName) AS ServiceName,
+                any(MetricName) AS MetricName,
+                any(MetricDescription) AS MetricDescription,
+                any(MetricUnit) AS MetricUnit,
+                any(Attributes) AS Attributes,
+                any(StartTimeUnix) AS StartTimeUnix,
+                any(Flags) AS Flags,
+                any(AggregationTemporality) AS AggregationTemporality,
+                any(IsMonotonic) AS IsMonotonic
+              FROM Source
+              GROUP BY AttributesHash, \`__hdx_time_bucket2\`
+              ORDER BY AttributesHash, \`__hdx_time_bucket2\`
+            )
           ) SELECT avg(
       toFloat64OrDefault(toString(Rate))
     ) AS "Value",toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` FROM Bucketed WHERE (\`__hdx_time_bucket2\` >= fromUnixTimestamp64Milli(1739318400000) AND \`__hdx_time_bucket2\` <= fromUnixTimestamp64Milli(1765670400000)) GROUP BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` ORDER BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` LIMIT 10 SETTINGS optimize_read_in_order = 0, cast_keep_nullable = 1, additional_result_filter = 'x != 2', count_distinct_implementation = 'uniqCombined64', async_insert_busy_timeout_min_ms = 20000"
 `;
 
+exports[`renderChartConfig should generate sql for a sum metric with aggFn=increase (Use Increase) 1`] = `
+"WITH Source AS (
+                SELECT
+                  *,
+                  cityHash64(mapConcat(ScopeAttributes, ResourceAttributes, Attributes)) AS AttributesHash,
+                  IF(
+                    AggregationTemporality = 1,
+                    Value, -- DELTA: Value is already the per-interval increase
+                    greatest(Value - lagInFrame(toNullable(Value), 1, NULL) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix), 0)
+                  ) AS Rate,
+                  IF(
+                    AggregationTemporality = 1,
+                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
+                    Value
+                  ) AS Sum
+                FROM default.otel_metrics_sum
+                WHERE (TimeUnix >= toStartOfInterval(fromUnixTimestamp64Milli(1739318400000), INTERVAL 5 minute) - INTERVAL 5 minute AND TimeUnix <= toStartOfInterval(fromUnixTimestamp64Milli(1765670400000), INTERVAL 5 minute) + INTERVAL 5 minute) AND ((MetricName = 'db.client.connections.usage'))),Bucketed AS (
+            SELECT
+              \`__hdx_time_bucket2\`,
+              AttributesHash,
+              Rate,
+              Sum,
+              ResourceAttributes,
+              ResourceSchemaUrl,
+              ScopeName,
+              ScopeVersion,
+              ScopeAttributes,
+              ScopeDroppedAttrCount,
+              ScopeSchemaUrl,
+              ServiceName,
+              MetricName,
+              MetricDescription,
+              MetricUnit,
+              Attributes,
+              StartTimeUnix,
+              Flags,
+              AggregationTemporality,
+              IsMonotonic
+            FROM (
+              SELECT
+                toStartOfInterval(toDateTime(TimeUnix), INTERVAL 5 minute) AS \`__hdx_time_bucket2\`,
+                AttributesHash,
+                -- Per-bucket increase: sum of raw per-row deltas. NULL
+                -- Source.Rate (first row of each partition) is ignored by sum().
+                sum(Source.Rate) AS Rate,
+                -- Last cumulative reading in the bucket (by time), used by
+                -- the no-aggFn last_value(Sum) outer projection. argMax is
+                -- deterministic w.r.t. TimeUnix ordering unlike last_value
+                -- which in a GROUP BY context is anyLast (order-dependent).
+                argMax(Source.Sum, TimeUnix) AS Sum,
+                any(ResourceAttributes) AS ResourceAttributes,
+                any(ResourceSchemaUrl) AS ResourceSchemaUrl,
+                any(ScopeName) AS ScopeName,
+                any(ScopeVersion) AS ScopeVersion,
+                any(ScopeAttributes) AS ScopeAttributes,
+                any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
+                any(ScopeSchemaUrl) AS ScopeSchemaUrl,
+                any(ServiceName) AS ServiceName,
+                any(MetricName) AS MetricName,
+                any(MetricDescription) AS MetricDescription,
+                any(MetricUnit) AS MetricUnit,
+                any(Attributes) AS Attributes,
+                any(StartTimeUnix) AS StartTimeUnix,
+                any(Flags) AS Flags,
+                any(AggregationTemporality) AS AggregationTemporality,
+                any(IsMonotonic) AS IsMonotonic
+              FROM Source
+              GROUP BY AttributesHash, \`__hdx_time_bucket2\`
+              ORDER BY AttributesHash, \`__hdx_time_bucket2\`
+            )
+          ) SELECT sum(
+      toFloat64OrDefault(toString(Rate))
+    ) AS "Value",toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` FROM Bucketed WHERE (\`__hdx_time_bucket2\` >= fromUnixTimestamp64Milli(1739318400000) AND \`__hdx_time_bucket2\` <= fromUnixTimestamp64Milli(1765670400000)) GROUP BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` ORDER BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` LIMIT 10 SETTINGS optimize_read_in_order = 0, cast_keep_nullable = 1, additional_result_filter = 'x != 2', count_distinct_implementation = 'uniqCombined64', async_insert_busy_timeout_min_ms = 20000"
+`;
+
+exports[`renderChartConfig should limit aggFn=increase + groupBy to the top 20 groups via a TopGroups CTE 1`] = `
+"WITH Source AS (
+                SELECT
+                  *,
+                  cityHash64(mapConcat(ScopeAttributes, ResourceAttributes, Attributes)) AS AttributesHash,
+                  IF(
+                    AggregationTemporality = 1,
+                    Value, -- DELTA: Value is already the per-interval increase
+                    greatest(Value - lagInFrame(toNullable(Value), 1, NULL) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix), 0)
+                  ) AS Rate,
+                  IF(
+                    AggregationTemporality = 1,
+                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
+                    Value
+                  ) AS Sum
+                FROM default.otel_metrics_sum
+                WHERE (TimeUnix >= toStartOfInterval(fromUnixTimestamp64Milli(1739318400000), INTERVAL 5 minute) - INTERVAL 5 minute AND TimeUnix <= toStartOfInterval(fromUnixTimestamp64Milli(1765670400000), INTERVAL 5 minute) + INTERVAL 5 minute) AND ((MetricName = 'db.client.connections.usage'))),Bucketed AS (
+            SELECT
+              \`__hdx_time_bucket2\`,
+              AttributesHash,
+              Rate,
+              Sum,
+              ResourceAttributes,
+              ResourceSchemaUrl,
+              ScopeName,
+              ScopeVersion,
+              ScopeAttributes,
+              ScopeDroppedAttrCount,
+              ScopeSchemaUrl,
+              ServiceName,
+              MetricName,
+              MetricDescription,
+              MetricUnit,
+              Attributes,
+              StartTimeUnix,
+              Flags,
+              AggregationTemporality,
+              IsMonotonic
+            FROM (
+              SELECT
+                toStartOfInterval(toDateTime(TimeUnix), INTERVAL 5 minute) AS \`__hdx_time_bucket2\`,
+                AttributesHash,
+                -- Per-bucket increase: sum of raw per-row deltas. NULL
+                -- Source.Rate (first row of each partition) is ignored by sum().
+                sum(Source.Rate) AS Rate,
+                -- Last cumulative reading in the bucket (by time), used by
+                -- the no-aggFn last_value(Sum) outer projection. argMax is
+                -- deterministic w.r.t. TimeUnix ordering unlike last_value
+                -- which in a GROUP BY context is anyLast (order-dependent).
+                argMax(Source.Sum, TimeUnix) AS Sum,
+                any(ResourceAttributes) AS ResourceAttributes,
+                any(ResourceSchemaUrl) AS ResourceSchemaUrl,
+                any(ScopeName) AS ScopeName,
+                any(ScopeVersion) AS ScopeVersion,
+                any(ScopeAttributes) AS ScopeAttributes,
+                any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
+                any(ScopeSchemaUrl) AS ScopeSchemaUrl,
+                any(ServiceName) AS ServiceName,
+                any(MetricName) AS MetricName,
+                any(MetricDescription) AS MetricDescription,
+                any(MetricUnit) AS MetricUnit,
+                any(Attributes) AS Attributes,
+                any(StartTimeUnix) AS StartTimeUnix,
+                any(Flags) AS Flags,
+                any(AggregationTemporality) AS AggregationTemporality,
+                any(IsMonotonic) AS IsMonotonic
+              FROM Source
+              GROUP BY AttributesHash, \`__hdx_time_bucket2\`
+              ORDER BY AttributesHash, \`__hdx_time_bucket2\`
+            )
+          ),TopGroups AS (
+            SELECT \`group\`
+            FROM (
+              SELECT
+                tuple(ServiceName) AS \`group\`,
+                sum(Rate) AS \`bucket_value\`
+              FROM Bucketed
+              WHERE (ServiceName IS NOT NULL AND toString(ServiceName) != '')
+              GROUP BY \`group\`, \`__hdx_time_bucket2\`
+            )
+            GROUP BY \`group\`
+            ORDER BY max(\`bucket_value\`) DESC, \`group\`
+            LIMIT 20
+          ) SELECT sum(
+      toFloat64OrDefault(toString(Rate))
+    ) AS "Value",ServiceName,toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` FROM Bucketed WHERE (\`__hdx_time_bucket2\` >= fromUnixTimestamp64Milli(1739318400000) AND \`__hdx_time_bucket2\` <= fromUnixTimestamp64Milli(1765670400000)) AND (tuple(ServiceName) IN (SELECT \`group\` FROM TopGroups)) GROUP BY ServiceName,toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` ORDER BY toStartOfInterval(toDateTime(\`__hdx_time_bucket2\`), INTERVAL 5 minute) AS \`__hdx_time_bucket\` LIMIT 100000 SETTINGS optimize_read_in_order = 0, cast_keep_nullable = 1, additional_result_filter = 'x != 2', count_distinct_implementation = 'uniqCombined64', async_insert_busy_timeout_min_ms = 20000"
+`;
+
 exports[`renderChartConfig should not generate invalid SQL when primary key wraps toStartOfInterval 1`] = `"SELECT timestamp, cluster_id, service_id FROM default.http_request_logs WHERE (timestamp >= fromUnixTimestamp64Milli(1739319154000) AND timestamp <= fromUnixTimestamp64Milli(1739491954000)) LIMIT 200 OFFSET 0 SETTINGS optimize_read_in_order = 0, cast_keep_nullable = 1, additional_result_filter = 'x != 2', count_distinct_implementation = 'uniqCombined64', async_insert_busy_timeout_min_ms = 20000"`;
diff --git a/packages/common-utils/src/__tests__/renderChartConfig.test.ts b/packages/common-utils/src/__tests__/renderChartConfig.test.ts
index c0a9c54db3..3895d66ef3 100644
--- a/packages/common-utils/src/__tests__/renderChartConfig.test.ts
+++ b/packages/common-utils/src/__tests__/renderChartConfig.test.ts
@@ -196,6 +196,319 @@ describe('renderChartConfig', () => {
     ).rejects.toThrow('multi select or string select on metrics not supported');
   });
 
+  it('should generate sql for a sum metric with aggFn=increase (Use Increase)', async () => {
+    const config: ChartConfigWithOptDateRange = {
+      displayType: DisplayType.Line,
+      connection: 'test-connection',
+      metricTables: {
+        gauge: 'otel_metrics_gauge',
+        histogram: 'otel_metrics_histogram',
+        sum: 'otel_metrics_sum',
+        summary: 'otel_metrics_summary',
+        'exponential histogram': 'otel_metrics_exponential_histogram',
+      },
+      from: {
+        databaseName: 'default',
+        tableName: '',
+      },
+      select: [
+        {
+          aggFn: 'increase',
+          aggCondition: '',
+          aggConditionLanguage: 'lucene',
+          valueExpression: 'Value',
+          metricName: 'db.client.connections.usage',
+          metricType: MetricsDataType.Sum,
+        },
+      ],
+      where: '',
+      whereLanguage: 'sql',
+      timestampValueExpression: 'TimeUnix',
+      dateRange: [new Date('2025-02-12'), new Date('2025-12-14')],
+      granularity: '5 minute',
+      limit: { limit: 10 },
+    };
+
+    const generatedSql = await renderChartConfig(
+      config,
+      mockMetadata,
+      querySettings,
+    );
+    const actual = parameterizedQueryToSql(generatedSql);
+    // Increase (Use Increase) sums Rate across sub-series sharing the same
+    // groupBy value (or all rows when no groupBy) to yield the per-bucket
+    // counter increase. The sum aggregation wraps its operand in a numeric
+    // cast (toFloat64OrDefault) so match that loosely.
+    expect(actual).toMatch(/sum\s*\([^)]*Rate[^)]*\)/);
+    // Rate is computed at the raw-row level in Source using lagInFrame,
+    // rather than diffing pre-bucketed values in Bucketed. This works even
+    // when a series only spans one bucket in the visible window.
+    expect(actual).toContain('lagInFrame');
+    // Counter resets / decreases are clamped to 0. Note: this differs from the
+    // Prometheus convention (which treats a reset as current_value assuming restart
+    // from 0), but avoids injecting post-reset spikes.
+    expect(actual).toContain('greatest(Value - lagInFrame');
+    // Crucially, the Rate formula must NOT gate on IsMonotonic.
+    expect(actual).not.toMatch(/IF\(IsMonotonic\s*=\s*0,\s*Value/);
+    expect(actual).toMatchSnapshot();
+  });
+
+  it('should limit aggFn=increase + groupBy to the top 20 groups via a TopGroups CTE', async () => {
+    const config: ChartConfigWithOptDateRange = {
+      displayType: DisplayType.Line,
+      connection: 'test-connection',
+      metricTables: {
+        gauge: 'otel_metrics_gauge',
+        histogram: 'otel_metrics_histogram',
+        sum: 'otel_metrics_sum',
+        summary: 'otel_metrics_summary',
+        'exponential histogram': 'otel_metrics_exponential_histogram',
+      },
+      from: {
+        databaseName: 'default',
+        tableName: '',
+      },
+      select: [
+        {
+          aggFn: 'increase',
+          aggCondition: '',
+          aggConditionLanguage: 'lucene',
+          valueExpression: 'Value',
+          metricName: 'db.client.connections.usage',
+          metricType: MetricsDataType.Sum,
+        },
+      ],
+      groupBy: [
+        {
+          aggCondition: '',
+          valueExpression: 'ServiceName',
+        },
+      ],
+      where: '',
+      whereLanguage: 'sql',
+      timestampValueExpression: 'TimeUnix',
+      dateRange: [new Date('2025-02-12'), new Date('2025-12-14')],
+      granularity: '5 minute',
+      limit: { limit: 100000 },
+    };
+
+    const generatedSql = await renderChartConfig(
+      config,
+      mockMetadata,
+      querySettings,
+    );
+    const actual = parameterizedQueryToSql(generatedSql);
+
+    // A "TopGroups" CTE should be emitted that picks the top N groups by
+    // max(sum(Rate) over buckets). The inner sum(Rate) matches the outer
+    // query's per-bucket aggregation, so a group with a spike in one bucket
+    // still qualifies for the top N.
+    expect(actual).toContain('TopGroups');
+    expect(actual).toMatch(/sum\(Rate\)\s+AS\s+`bucket_value`/);
+    expect(actual).toMatch(/ORDER\s+BY\s+max\(`bucket_value`\)\s+DESC/);
+    expect(actual).toContain('LIMIT 20');
+    // Rows where the groupBy value is NULL or empty must be excluded so they
+    // don't dominate the chart as a single '-' series.
+    expect(actual).toMatch(
+      /ServiceName\s+IS\s+NOT\s+NULL\s+AND\s+toString\(ServiceName\)\s*!=\s*''/,
+    );
+    // The outer query should restrict to the top groups via an IN subquery.
+    expect(actual).toMatch(
+      /tuple\(ServiceName\)\s+IN\s*\(\s*SELECT\s+`group`\s+FROM\s+TopGroups\)/,
+    );
+    // Outer query reads from Bucketed and sums Rate across sub-series.
+    expect(actual).toMatch(/FROM\s+Bucketed/);
+    expect(actual).toMatch(/sum\s*\([^)]*Rate[^)]*\)/);
+    expect(actual).toMatchSnapshot();
+  });
+
+  it('should render rank where as SQL even when whereLanguage is lucene (regression)', async () => {
+    // Regression: if the user's config has whereLanguage='lucene' and we set a
+    // raw SQL where clause (rank filter) internally, renderWhere must parse it
+    // as SQL. Otherwise the Lucene parser fails with "Can not search bare text
+    // without an implicit column set".
+    const config: ChartConfigWithOptDateRange = {
+      displayType: DisplayType.Line,
+      connection: 'test-connection',
+      metricTables: {
+        gauge: 'otel_metrics_gauge',
+        histogram: 'otel_metrics_histogram',
+        sum: 'otel_metrics_sum',
+        summary: 'otel_metrics_summary',
+        'exponential histogram': 'otel_metrics_exponential_histogram',
+      },
+      from: { databaseName: 'default', tableName: '' },
+      select: [
+        {
+          aggFn: 'increase',
+          aggCondition: '',
+          aggConditionLanguage: 'lucene',
+          valueExpression: 'Value',
+          metricName: 'db.client.connections.usage',
+          metricType: MetricsDataType.Sum,
+        },
+      ],
+      groupBy: [{ aggCondition: '', valueExpression: 'ServiceName' }],
+      where: '',
+      whereLanguage: 'lucene',
+      timestampValueExpression: 'TimeUnix',
+      dateRange: [new Date('2025-02-12'), new Date('2025-12-14')],
+      granularity: '5 minute',
+      limit: { limit: 100000 },
+    };
+
+    // Should not throw.
+    const generatedSql = await renderChartConfig(
+      config,
+      mockMetadata,
+      querySettings,
+    );
+    const actual = parameterizedQueryToSql(generatedSql);
+    expect(actual).toContain('TopGroups');
+  });
+
+  it('should handle aggFn=increase with multi-column groupBy', async () => {
+    const config: ChartConfigWithOptDateRange = {
+      displayType: DisplayType.Line,
+      connection: 'test-connection',
+      metricTables: {
+        gauge: 'otel_metrics_gauge',
+        histogram: 'otel_metrics_histogram',
+        sum: 'otel_metrics_sum',
+        summary: 'otel_metrics_summary',
+        'exponential histogram': 'otel_metrics_exponential_histogram',
+      },
+      from: {
+        databaseName: 'default',
+        tableName: '',
+      },
+      select: [
+        {
+          aggFn: 'increase',
+          aggCondition: '',
+          aggConditionLanguage: 'lucene',
+          valueExpression: 'Value',
+          metricName: 'db.client.connections.usage',
+          metricType: MetricsDataType.Sum,
+        },
+      ],
+      groupBy: [
+        { aggCondition: '', valueExpression: 'ServiceName' },
+        { aggCondition: '', valueExpression: "Attributes['env']" },
+      ],
+      where: '',
+      whereLanguage: 'sql',
+      timestampValueExpression: 'TimeUnix',
+      dateRange: [new Date('2025-02-12'), new Date('2025-12-14')],
+      granularity: '5 minute',
+      limit: { limit: 100000 },
+    };
+
+    const generatedSql = await renderChartConfig(
+      config,
+      mockMetadata,
+      querySettings,
+    );
+    const actual = parameterizedQueryToSql(generatedSql);
+    // Both groupBy expressions should be packed into a tuple() in the TopGroups
+    // CTE and outer WHERE.
+    expect(actual).toMatch(
+      /tuple\(\s*ServiceName\s*,\s*Attributes\[['"]env['"]\]\s*\)/,
+    );
+    expect(actual).toContain('TopGroups');
+    expect(actual).toContain('LIMIT 20');
+    // Each groupBy column is individually filtered against NULL/empty to
+    // prevent a single empty series from dominating the chart.
+    expect(actual).toMatch(
+      /ServiceName\s+IS\s+NOT\s+NULL\s+AND\s+toString\(ServiceName\)\s*!=\s*''/,
+    );
+    expect(actual).toMatch(
+      /Attributes\[['"]env['"]\]\s+IS\s+NOT\s+NULL\s+AND\s+toString\(Attributes\[['"]env['"]\]\)\s*!=\s*''/,
+    );
+  });
+
+  it('should not emit a rank CTE when aggFn=increase has no groupBy', async () => {
+    const config: ChartConfigWithOptDateRange = {
+      displayType: DisplayType.Line,
+      connection: 'test-connection',
+      metricTables: {
+        gauge: 'otel_metrics_gauge',
+        histogram: 'otel_metrics_histogram',
+        sum: 'otel_metrics_sum',
+        summary: 'otel_metrics_summary',
+        'exponential histogram': 'otel_metrics_exponential_histogram',
+      },
+      from: {
+        databaseName: 'default',
+        tableName: '',
+      },
+      select: [
+        {
+          aggFn: 'increase',
+          aggCondition: '',
+          aggConditionLanguage: 'lucene',
+          valueExpression: 'Value',
+          metricName: 'db.client.connections.usage',
+          metricType: MetricsDataType.Sum,
+        },
+      ],
+      where: '',
+      whereLanguage: 'sql',
+      timestampValueExpression: 'TimeUnix',
+      dateRange: [new Date('2025-02-12'), new Date('2025-12-14')],
+      granularity: '5 minute',
+      limit: { limit: 10 },
+    };
+
+    const generatedSql = await renderChartConfig(
+      config,
+      mockMetadata,
+      querySettings,
+    );
+    const actual = parameterizedQueryToSql(generatedSql);
+    expect(actual).not.toContain('TopGroups');
+  });
+
+  it('should throw when aggFn=increase is used on a non-Sum metric', async () => {
+    const config: ChartConfigWithOptDateRange = {
+      displayType: DisplayType.Line,
+      connection: 'test-connection',
+      metricTables: {
+        gauge: 'otel_metrics_gauge',
+        histogram: 'otel_metrics_histogram',
+        sum: 'otel_metrics_sum',
+        summary: 'otel_metrics_summary',
+        'exponential histogram': 'otel_metrics_exponential_histogram',
+      },
+      from: {
+        databaseName: 'default',
+        tableName: '',
+      },
+      select: [
+        {
+          aggFn: 'increase',
+          aggCondition: '',
+          aggConditionLanguage: 'lucene',
+          valueExpression: 'Value',
+          metricName: 'nodejs.event_loop.utilization',
+          metricType: MetricsDataType.Gauge,
+        },
+      ],
+      where: '',
+      whereLanguage: 'sql',
+      timestampValueExpression: 'TimeUnix',
+      dateRange: [new Date('2025-02-12'), new Date('2025-12-14')],
+      granularity: '5 minute',
+      limit: { limit: 10 },
+    };
+
+    await expect(
+      renderChartConfig(config, mockMetadata, querySettings),
+    ).rejects.toThrow(
+      "aggFn 'increase' is only supported for Sum (counter) metrics",
+    );
+  });
+
   describe('histogram metric queries', () => {
     describe('quantile', () => {
       it('should generate a query without grouping or time bucketing', async () => {
diff --git a/packages/common-utils/src/core/renderChartConfig.ts b/packages/common-utils/src/core/renderChartConfig.ts
index 681dfb4099..9c8a6f0d4e 100644
--- a/packages/common-utils/src/core/renderChartConfig.ts
+++ b/packages/common-utils/src/core/renderChartConfig.ts
@@ -76,6 +76,9 @@ function determineTableName(select: SelectSQLStatement): string {
 const DEFAULT_METRIC_TABLE_TIME_COLUMN = 'TimeUnix';
 export const FIXED_TIME_BUCKET_EXPR_ALIAS = '__hdx_time_bucket';
 
+// Maximum number of distinct groups shown in a time chart when using 'increase' with a groupBy.
+const INCREASE_MAX_NUM_GROUPS = 20;
+
 export function isUsingGroupBy(
   chartConfig: BuilderChartConfigWithOptDateRange,
 ): chartConfig is Omit<BuilderChartConfigWithDateRange, 'groupBy'> & {
@@ -121,9 +124,11 @@ export const setChartSelectsAlias = (
         ...s,
         alias:
           s.alias ||
-          (s.isDelta
-            ? `${s.aggFn}(delta(${s.metricName}))`
-            : `${s.aggFn}(${s.metricName})`), // use an alias if one isn't already set
+          (s.aggFn === 'increase'
+            ? `increase(${s.metricName})`
+            : s.isDelta
+              ? `${s.aggFn}(delta(${s.metricName}))`
+              : `${s.aggFn}(${s.metricName})`), // use an alias if one isn't already set
       })),
     };
   }
@@ -1219,6 +1224,14 @@ async function translateMetricChartConfig(
   }
 
   const { metricType, metricName, metricNameSql, ..._select } = select[0]; // Initial impl only supports one metric select per chart config
+
+  // 'increase' is only valid for Sum metrics.
+  if (_select.aggFn === 'increase' && metricType !== MetricsDataType.Sum) {
+    throw new Error(
+      `aggFn 'increase' is only supported for Sum (counter) metrics (got metricType=${metricType})`,
+    );
+  }
+
   if (
     metricType === MetricsDataType.Gauge &&
     metricName &&
@@ -1318,8 +1331,6 @@ async function translateMetricChartConfig(
     metricTables[MetricsDataType.Sum]
   ) {
     const timeBucketCol = '__hdx_time_bucket2';
-    const valueHighCol = '`__hdx_value_high`';
-    const valueHighPrevCol = '`__hdx_value_high_prev`';
     const timeExpr = timeBucketExpr({
       interval: chartConfig.granularity || 'auto',
       timestampValueExpression:
@@ -1361,81 +1372,208 @@ async function translateMetricChartConfig(
      *
      * Note, IsMonotonic = 0, has Cumulative agg temporality
      */
-    return {
-      ...restChartConfig,
-      with: [
-        {
-          name: 'Source',
-          sql: chSql`
+    const sumWith: NonNullable<BuilderChartConfigWithOptDateRangeEx['with']> = [
+      {
+        // Source: per-raw-row counter delta (Rate) and cumulative value (Sum)
+        // for each (AttributesHash, TimeUnix) point. On the first row of each
+        // series partition, lagInFrame returns NULL; `Value - NULL` is NULL,
+        // and `greatest(NULL, 0)` resolves to 0 — so Rate is 0 (contributing
+        // nothing to the bucket sum) rather than leaking the cumulative value.
+        //
+        // Counter-reset handling: `greatest(..., 0)` clamps negative deltas
+        // (counter resets/decreases) to 0. This differs from the Prometheus
+        // convention where a reset is treated as `current_value` (assuming
+        // the counter restarted from 0). The clamping approach under-reports
+        // the increase in the bucket immediately after a reset, but avoids
+        // injecting the full post-reset value as a spike.
+        name: 'Source',
+        sql: chSql`
                 SELECT
                   *,
                   cityHash64(mapConcat(ScopeAttributes, ResourceAttributes, Attributes)) AS AttributesHash,
-                  IF(AggregationTemporality = 1,
-                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY AttributesHash, TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
-                    IF(IsMonotonic = 0, 
-                      Value,
-                      deltaSum(Value) OVER (PARTITION BY AttributesHash ORDER BY AttributesHash, TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW)
-                    )
+                  IF(
+                    AggregationTemporality = 1,
+                    Value, -- DELTA: Value is already the per-interval increase
+                    greatest(Value - lagInFrame(toNullable(Value), 1, NULL) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix), 0)
                   ) AS Rate,
-                  IF(AggregationTemporality = 1, Rate, Value) AS Sum
+                  IF(
+                    AggregationTemporality = 1,
+                    SUM(Value) OVER (PARTITION BY AttributesHash ORDER BY TimeUnix ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW),
+                    Value
+                  ) AS Sum
                 FROM ${renderFrom({ from: { ...from, tableName: metricTables[MetricsDataType.Sum] } })}
                 WHERE ${where}`,
-        },
-        {
-          name: 'Bucketed',
-          sql: chSql`
+      },
+      {
+        // Bucketed: one row per (AttributesHash, bucket). The aggregation is
+        // wrapped in an inner subquery so ClickHouse exposes Rate/Sum as plain
+        // columns; without the wrapper, outer `sum(Rate)` would lexically
+        // expand to the rejected `sum(sum(Source.Rate))`.
+        name: 'Bucketed',
+        sql: chSql`
             SELECT
-              ${timeExpr},
+              \`${timeBucketCol}\`,
               AttributesHash,
-              last_value(Source.Rate) AS ${valueHighCol},
-              any(${valueHighCol}) OVER(PARTITION BY AttributesHash ORDER BY \`${timeBucketCol}\` ROWS BETWEEN 1 PRECEDING AND 1 PRECEDING) AS ${valueHighPrevCol},
-              IF(IsMonotonic = 1, ${valueHighCol} - ${valueHighPrevCol}, ${valueHighCol}) AS Rate,
-              last_value(Source.Sum) AS Sum,
-              any(ResourceAttributes) AS ResourceAttributes,
-              any(ResourceSchemaUrl) AS ResourceSchemaUrl,
-              any(ScopeName) AS ScopeName,
-              any(ScopeVersion) AS ScopeVersion,
-              any(ScopeAttributes) AS ScopeAttributes,
-              any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
-              any(ScopeSchemaUrl) AS ScopeSchemaUrl,
-              any(ServiceName) AS ServiceName,
-              any(MetricName) AS MetricName,
-              any(MetricDescription) AS MetricDescription,
-              any(MetricUnit) AS MetricUnit,
-              any(Attributes) AS Attributes,
-              any(StartTimeUnix) AS StartTimeUnix,
-              any(Flags) AS Flags,
-              any(AggregationTemporality) AS AggregationTemporality,
-              any(IsMonotonic) AS IsMonotonic
-            FROM Source
-            GROUP BY AttributesHash, \`${timeBucketCol}\`
-            ORDER BY AttributesHash, \`${timeBucketCol}\`
+              Rate,
+              Sum,
+              ResourceAttributes,
+              ResourceSchemaUrl,
+              ScopeName,
+              ScopeVersion,
+              ScopeAttributes,
+              ScopeDroppedAttrCount,
+              ScopeSchemaUrl,
+              ServiceName,
+              MetricName,
+              MetricDescription,
+              MetricUnit,
+              Attributes,
+              StartTimeUnix,
+              Flags,
+              AggregationTemporality,
+              IsMonotonic
+            FROM (
+              SELECT
+                ${timeExpr},
+                AttributesHash,
+                -- Per-bucket increase: sum of raw per-row deltas. NULL
+                -- Source.Rate (first row of each partition) is ignored by sum().
+                sum(Source.Rate) AS Rate,
+                -- Last cumulative reading in the bucket (by time), used by
+                -- the no-aggFn last_value(Sum) outer projection. argMax is
+                -- deterministic w.r.t. TimeUnix ordering unlike last_value
+                -- which in a GROUP BY context is anyLast (order-dependent).
+                argMax(Source.Sum, TimeUnix) AS Sum,
+                any(ResourceAttributes) AS ResourceAttributes,
+                any(ResourceSchemaUrl) AS ResourceSchemaUrl,
+                any(ScopeName) AS ScopeName,
+                any(ScopeVersion) AS ScopeVersion,
+                any(ScopeAttributes) AS ScopeAttributes,
+                any(ScopeDroppedAttrCount) AS ScopeDroppedAttrCount,
+                any(ScopeSchemaUrl) AS ScopeSchemaUrl,
+                any(ServiceName) AS ServiceName,
+                any(MetricName) AS MetricName,
+                any(MetricDescription) AS MetricDescription,
+                any(MetricUnit) AS MetricUnit,
+                any(Attributes) AS Attributes,
+                any(StartTimeUnix) AS StartTimeUnix,
+                any(Flags) AS Flags,
+                any(AggregationTemporality) AS AggregationTemporality,
+                any(IsMonotonic) AS IsMonotonic
+              FROM Source
+              GROUP BY AttributesHash, \`${timeBucketCol}\`
+              ORDER BY AttributesHash, \`${timeBucketCol}\`
+            )
           `,
-        },
-      ],
+      },
+    ];
+
+    // For aggFn='increase' + groupBy, restrict the outer query to the top N
+    // groups (mirrors v1's MAX_NUM_GROUPS). Ranking is done in a separate
+    // CTE rather than a window, since ClickHouse can't reference a
+    // window-aggregate inside another window's ORDER BY.
+    const shouldApplyIncreaseGroupLimit =
+      _select.aggFn === 'increase' && isUsingGroupBy(chartConfig);
+
+    let outerWhere: string = '';
+
+    if (shouldApplyIncreaseGroupLimit) {
+      // Render the user's groupBy against the Bucketed CTE so column
+      // references resolve to the CTE's projection.
+      const groupByForRank = await renderSelectList(
+        chartConfig.groupBy!,
+        {
+          ...chartConfig,
+          from: { databaseName: '', tableName: 'Bucketed' },
+          with: sumWith,
+        } as BuilderChartConfigWithOptDateRangeEx,
+        metadata,
+      );
+      const groupBySql = concatChSql(',', groupByForRank);
+
+      // Exclude rows where any groupBy column is NULL/empty so they don't
+      // collapse into a single dominating '-' series.
+      const groupByEmptyFilter = concatChSql(
+        ' AND ',
+        (Array.isArray(groupByForRank) ? groupByForRank : [groupByForRank]).map(
+          g => chSql`(${g} IS NOT NULL AND toString(${g}) != '')`,
+        ),
+      );
+
+      // Rank by max-per-bucket summed Rate so a group that spikes in one
+      // bucket still makes the top N. tuple() wraps multi-column groupBys
+      // into a single comparable column.
+      sumWith.push({
+        name: 'TopGroups',
+        sql: chSql`
+            SELECT \`group\`
+            FROM (
+              SELECT
+                tuple(${groupBySql}) AS \`group\`,
+                sum(Rate) AS \`bucket_value\`
+              FROM Bucketed
+              WHERE ${groupByEmptyFilter}
+              GROUP BY \`group\`, \`${timeBucketCol}\`
+            )
+            GROUP BY \`group\`
+            ORDER BY max(\`bucket_value\`) DESC, \`group\`
+            LIMIT ${{ Int32: INCREASE_MAX_NUM_GROUPS }}
+          `,
+      });
+
+      // Safety: groupBySql is built from metric groupBy expressions which are
+      // always simple column references (UNSAFE_RAW_SQL). Verify no parameterized
+      // values leaked through — if they did, .sql would contain param placeholders
+      // but the string-based outer WHERE would lose the param bindings.
+      if (Object.keys(groupBySql.params).length > 0) {
+        throw new Error(
+          'increase + groupBy: unexpected parameterized groupBy expressions',
+        );
+      }
+      outerWhere = `tuple(${groupBySql.sql}) IN (SELECT \`group\` FROM TopGroups)`;
+    }
+
+    return {
+      ...restChartConfig,
+      with: sumWith,
       select: [
-        // HDX-1543: If the chart config query asks for an aggregation, the use the computed rate value, otherwise
-        // use the underlying summed value. The alias field appears before the spread so user defined aliases will
-        // take precedent over our generic value.
-        _select.aggFn
+        // HDX-1543: aggFn => use computed rate; no aggFn => use raw cumulative.
+        // For 'increase', sum Rate across sub-series that share the user's
+        // groupBy (e.g. groupBy teamName while rows also vary by customerId).
+        _select.aggFn === 'increase'
           ? {
               alias: 'Value',
               ..._select,
+              aggFn: 'sum',
               valueExpression: 'Rate',
               aggCondition: '',
             }
-          : {
-              alias: 'Value',
-              ..._select,
-              valueExpression: 'last_value(Sum)',
-              aggCondition: '',
-            },
+          : _select.aggFn
+            ? {
+                alias: 'Value',
+                ..._select,
+                valueExpression: 'Rate',
+                aggCondition: '',
+              }
+            : {
+                alias: 'Value',
+                ..._select,
+                valueExpression: 'last_value(Sum)',
+                aggCondition: '',
+              },
       ],
       from: {
         databaseName: '',
         tableName: 'Bucketed',
       },
-      where: '', // clear up the condition since the where clause is already applied at the upstream CTE
+      // outerWhere is only set when restricting to top-N groups; otherwise
+      // cleared since the upstream CTE already applied the user's where.
+      // Force SQL parsing because outerWhere is raw SQL referencing
+      // TopGroups; the user's whereLanguage may be Lucene.
+      where: outerWhere,
+      whereLanguage: shouldApplyIncreaseGroupLimit
+        ? 'sql'
+        : restChartConfig.whereLanguage,
       timestampValueExpression: `\`${timeBucketCol}\``,
     };
   } else if (
diff --git a/packages/common-utils/src/types.ts b/packages/common-utils/src/types.ts
index ff77d89566..2427834b65 100644
--- a/packages/common-utils/src/types.ts
+++ b/packages/common-utils/src/types.ts
@@ -145,6 +145,9 @@ export const AggregateFunctionSchema = z.enum([
   'sum',
   'any',
   'none',
+  // 'increase' is only valid for Sum (counter) metrics. It returns the
+  // per-bucket increase of the counter, accounting for counter resets.
+  'increase',
 ]);
 export const InternalAggregateFunctionSchema = z.enum([
   ...AggregateFunctionSchema.options,