Charting Assistance

[yepyepyayyooo]

I'm having an issue with a visualization. Works fine if I don't try to do the fancy eval but won't plot out in visualization when I do.

index="bro" sourcetype="bro_conn" dest_ipi_zone="INT" dest_ipi_zone="INT" TERM(1.1.1.1) bytes>=50000
| eval bytes+=case( 
    bytes>=(1024*1024*1024*1024),round(bytes/(1024*1024*1024*1024),0)." TB",
    bytes>=(1024*1024*1024),round(bytes/(1024*1024*1024),0)." GB",
    bytes>=(1024*1024),round(bytes/(1024*1024),0)." MB",
    bytes>=1024,round(bytes/1024,0)." KB",
    1=1,bytes." B")
| lookup dnslookup clientip as dest_ip output clienthost as dest_dns
| eval time=strftime(_time,"%Y/%m/%d %H:%M")
| bucket time span=4h 
| chart values(bytes+) by time dest_dns usenull=f useother=f limit=5

[richgalloway]

By "fancy eval" do you mean the eval that creates the 'bytes+' field? If so, have you tried using a field name without '+' in it?

[yepyepyayyooo]

Yes, that's just the name of the new field. I named it bytess, bytes1, etc. Doesn't make a difference :'(

[richgalloway]

So what is the query that works?

[yepyepyayyooo]

I don't know, that's what I'm asking Splunk Answers for.

[richgalloway]

"Works fine if I don't try to do the fancy eval ". Please share the part that works fine.