This may be happening because you have defined overlapping eventtypes. Thus when you search for results of either type, you get the eventtype field populated with multiple values.
Run your search without the timechart, select the "eventtype" field from the "interesting fields", and see what is being populated. If you are getting multiple values in your eventtype field, you will want to do something like this before the timechart:
...| eval eventtype=case(like(eventtype,"%cisco_fw_dmz%"),"cisco_fw_dmz",like(eventtype,"%cisco_fw_inside%"),"cisco_fw_inside", eventtype) |...
... View more