Although it's intuitive to us, Splunk doesn't quite understand what you're trying to do here. It's assuming your first value, which is sum(Sub1s), is the value you want to chart all of the values by or over.
Try this instead -- I've added a seemingly superfluous eval into a field named time_categories, which is then used with your chart statement:
index=tomcat time_taken_ms=* sourcetype=access_common
| eval time_categories = "time_categories"
| eval Sub1s=if(time_taken_ms>=200 AND time_taken_ms<1000,1,0)
| eval Sub2s=if(time_taken_ms>=1000 AND time_taken_ms<2000,1,0)
| eval Sub3s=if(time_taken_ms>=2000 AND time_taken_ms<3000,1,0)
| eval Sub4s=if(time_taken_ms>=3000 AND time_taken_ms<4000,1,0)
| eval Sub5s=if(time_taken_ms>=4000 AND time_taken_ms<5000,1,0)
| eval Over5s=if(time_taken_ms>=5000 AND time_taken_ms<10000,1,0)
| eval Over10s=if(time_taken_ms>=10000,1,0)
| chart sum(Sub1s) sum(Sub2s) sum(Sub3s) sum(Sub4s) sum(Sub5s) sum(Over5s) sum(Over10s) BY time_categories
There's also another way of doing this without so much maintenance...
If you wanted to add another time category with your current query, you'd have to add the new eval statement and update your chart statement. Rather than individual fields, why not make a single field and use an eval case combination?
index=tomcat time_taken_ms=* sourcetype=access_common
| eval time_category = case(time_taken_ms>=200 AND time_taken_ms<1000,"Sub1s",time_taken_ms>=1000 AND time_taken_ms<2000,"Sub2s",time_taken_ms>=2000 AND time_taken_ms<3000,"Sub3s",time_taken_ms>=3000 AND time_taken_ms<4000,"Sub4s",time_taken_ms>=4000 AND time_taken_ms<5000,"Sub5s",time_taken_ms>=5000 AND time_taken_ms<10000,"Over5s",time_taken_ms>=10000,"Over10s")
| chart count by time_category
Now adding a new time category is as simple as updating the case statement. The chart statement will automatically pick it up.
Hope that helps!
rmmiller
