When using timechart, only one field can be listed after a by clause because _time is already implied as the x-axis. The timechart command in a query inherently focuses on time-series data, where _time is plotted on the x-axis. Therefore, you can only specify one additional field to be used for grouping the data.