Telegraf snmp InfluxDB grafana - aggregate bandwith from multiple interfaces

using InfluxDB 1.8.3, Grafana 7.3.7

I feel like this should be easy and done quite frequently, but not finding the answer after searching and fiddling around with this.

I can graph each interface the normal way,
SELECT non_negative_derivative(mean(“ifHCInOctets”), 1s) *8 AS “in” FROM “interface” WHERE (“agent_host” = ‘xxxx’ AND “ifAlias” =~ /sometag/) AND timeFilter GROUP BY time(__interval) fill(null)

I would like to do a combined graph with the total bandwidth in/out

SELECT non_negative_derivative(sum(“ifHCInOctets”), 1s) *8 FROM “interface” WHERE (“ifAlias” =~ /GFNA01/ AND “agent_host” =~ /regexp to select routers/) AND $timeFilter GROUP BY time(1m)

so selecting interfaces with GFNA01 in the description and then regexping the hosts.

I might be misunderstanding something here, but I format the Y axis as data rate bits/s and get some Pb/s , expecting ~30Gb/s. Playing with the GROUP BY time affects the number. So there is something basic wrong with this, the FROM is (should) returning counters from 8 interfaces.

any help greatly appreciated.