Timechart with added series

[michaelmathis]

I have some records that show interface utilization across multiple devices.  I would like to add the utilization from two different devices so that two series are presented on my timechart, summary of inbound utilization for devices A + B, and summary of outbound utilization for devices A+B.

index=nnmperf "Interface Name"="Te0/1/0" "Node Name"="A" OR "Node Name"="B"
| rename "Utilization In" as In
| rename "Utilization Out" as Out
| eval In=In*100
| eval Out=Out*100
| timechart span=30m avg(In) avg(Out) by "Node Name"

I've tried to pipe the chart to addTotals, but I can't figure out how to split the total into two series one for inbound and one for outbound. 

Could someone help me out?  Thank you!

[michaelmathis]

Thank you for your help!

[ITWhisperer · Accepted solution]

| gentimes start=-1 increment=10s 
| eval node=mvindex(split("AB",""),random()%2)
| eval in=random()%100
| eval out=random()%100
| rename starttime as _time 
| table _time node in out


| timechart span=30m avg(in) avg(out) by node
| eval "total: A"='avg(in): A'+'avg(out): A'
| eval "total: B"='avg(in): B'+'avg(out): B'