Thank you @niketnilay for the detailed response.
My final successful search was as follows:
`index=sampleindex dvc_name=sampledevice dest_interface=tunnel.44 OR src_interface=tunnel.44
| eval inbound_traffic_bytes=case(src_interface=="tunnel.44",bytes_in,
dest_interface=="tunnel.44",bytes_out), outbound_traffic_bytes=case(src_interface=="tunnel.44",bytes_out,
dest_interface=="tunnel.44",bytes_in)
| eval inbound_traffic_megabytes=inbound_traffic_bytes/1024/1024
| eval outbound_traffic_megabytes=outbound_traffic_bytes/1024/1024
| timechart sum(inbound_traffic_megabytes) as "Inbound" sum(outbound_traffic_megabytes) as "Outbound" `
... View more