Okay, a new attempt. I probably should not have calculated the MB until the end, as the number of bytes is small. Also, I have some concerns about the actual contents of your fields.
Start with this to debug your fields
sourcetype=Juniper "closed"
| eval TotalBytes = bytesRead + bytesWritten
| eval Date=relative_time(_time,"@d")
| rename SRCIP as SourceIP
| fieldformat Date=strftime(Date,"%x")
| fieldformat timestamp=strftime(_time,"%x %X")
| eval MB = tostring(round(TotalBytes/1024/1024,2)) + " MB"
| table timestamp Date Username SourceIP bytesRead bytesWritten TotalBytes MB time
If that looks okay, then you can move on to
sourcetype=Juniper "closed"
| eval bytes = bytesRead + bytesWritten
| eval Date=relative_time(_time,"@d")
| rename SRCIP as SourceIP
| stats sum(bytes) as TotalBytes sum(time) as TotalTime by Date Username SourceIP
| fieldformat Date=strftime(Date,"%x")
| eval MB = tostring(round(TotalBytes/1024/1024,2)) + " MB"
And finally
sourcetype=Juniper "closed"
| eval bytes = bytesRead + bytesWritten
| eval Date=relative_time(_time,"@d")
| rename SRCIP as SourceIP
| stats sum(bytes) as TotalBytes sum(time) as TotalTime by Date Username SourceIP
| fieldformat Date=strftime(Date,"%x")
| eval TotalBytes = tostring(round(TotalBytes/1024/1024,2)) + " MB"
| fieldformat TotalTime = tostring(TotalTime,"duration")
... View more