You can only have a single aggregating function in a timechart call
You’re trying to do two count functions
timechart will only do one
from User warren – Stack Overflow https://stackoverflow.com/questions/69380033/adding-multiple-expressions-to-single-searchmatch-in-splunk-query/69436698#69436698
via IFTTT