Here is the search, putting results in a summary index.
sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | sitimechart span=1h count(dtime>=60), count(dtime>=120), count(dtime>=180)
(longhand version)
sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | sitimechart span=1h count(dtime>=60), count(dtime>=120), count(dtime>=180) | summaryindex spool=t uselb=t addtime=t index="dtime_plus_60" file="Summary Index DTime 60+,120+,180+ per Hour_1480261911.stash_new" name="Summary Index DTime 60+,120+,180+ per Hour" marker=""
Now here is what ends up being in the summary index:
10/18/2012 10:00:00, search_name="Summary Index DTime 60+,120+,180+ per Hour", search_now=1350576300.000, info_min_time=1350568800.000, info_max_time=1350572400.000, info_search_time=1350576324.840, psrsvd_gc=27, psrsvd_v=1
If you just use a normal timechart command are you getting the expected results (3 groups) from your search?
Your summary index output seems to reflect only 1 count of results (no grouping!) being saved (as per your question).
edit: Actually, looking at your search I wouldn't have expected "count(dtime>=60), count(dtime>=120), count(dtime>=180)" to actually output anything.
So your original search needs to be fixed with something like this perhaps :
| eval dtime_group=case(dtime <= "60" , "less60", dtime >= "61" AND dtime <= "120", "lessthan120", dtime >="180", "lessthan180") | timechart count by dtime_group
The non-si version of the search properly returns 3 columns.
sourcetype=\"SmtpPrevent_operational\" dtime=*s | convert auto(dtime) | search dtime>=60 | timechart span=1d count(eval(dtime>=60)) as 60+, count(eval(dtime>=120)) as 120+, count(eval(dtime>=180)) as 180+'