Help with dashboard/data type (snmp counter / "gauge" metric)

Hello, 

I'm currently looking to create a dashboard to show a representation of hits on a counter that are collected as "gauge" (specifically, this value is from SNMP and should only increase as it is "TotalPolicyHits").  However, I'm looking for a meaningful way to represent this total on a dashboard.  

Currently we have 4 principal things we're looking to visualize:  Whitelisted IP hits, Blacklisted IP hits, "friendly location" IP hits, "Unfriendly location" IP hits.  

In terms of data, "friendly" location is a huge number relative to the others (~14x more than the next number).  

I was wondering what options may look the best for visualizing this.  I had the idea that it may be better to instead to represent the data as a rate (i.e. 80% of the hits are from the friendly policy, 10% from unfriendly, 5% from whitelist, 5% from blacklist) over the last interval.  However the current counter is stored as a gauge and comes from SNMP as counter.  

I've looked over the documentation and am unclear if I need to add another datapoint as 'derive' which will recalculate that for me, or if I need to do math to represent it.  Since these are "Total" values that will only increase, is there a way I can do the math to calculate CurrentReading - LastReading to get the difference? I didn't see anything like that in the Datapoint expressions page.

Any advice you can give would be appreciated.