Your issue is to do with the chart command, it only really supports two dimensions, in your case these appear to be work_queue and range, when you need three dimensions, work_queue, range and current...
See more...
Your issue is to do with the chart command, it only really supports two dimensions, in your case these appear to be work_queue and range, when you need three dimensions, work_queue, range and current_ticket_state. This means you will have to use a stats command, then combine the work_queue and current_ticket_state into a single field, then chart using the combined field and range, then split the combined field back into two fields. Try something like this | stats count by work_queue current_ticket_state range
| eval combined=work_queue."|".range
| chart max(count) by combined range
| eval work_queue=mvindex(split(combined,"|"),0)
| eval current_ticket_state=mvindex(split(combined,"|"),1)
| fields - combined