How to create an overlay of the avg number of blocks over total sessions?

[jwalzerpitt]

I am trying to create a timechart overlay of blocked  traffic comparted to total traffic with the following search:

| tstats count AS "Total Traffic" from datamodel=Network_Traffic where (nodename = All_Traffic ) OR (nodename = Blocked_Traffic) All_Traffic.src_zone=INTERNET-O groupby _time span=1d, All_Traffic.src_zone, All_Traffic.action, All_Traffic.Traffic_By_Action.Blocked_Traffic prestats=true 
| `drop_dm_object_name("All_Traffic")` 
| timechart span=1d count by action 
| eval "Block Avg" = round('blocked'*100/('allowed'+'blocked'),2)

 This search has two issues:

1. Timechart shows bars by action and 'd like to see just the total count of network sessions
2. The average is basically flatlined as it's at roughly 40% whereas my totals by action are roughly 1.5B