Try this:
| eval Timenow=now()
| convert timeformat="%Y/%m/%d" mktime(_time) as date_provisioned
| eval days_since_provisioned=Timenow-floor(date_provisioned)
| eval bucket=case(days_since_provisioned<=179, "Less Than 180", days_since_provisioned<=210, "180-210", days_sinced_provisioned>=210, "Greater Than 210")
| chart count by bucket
I do not think you had your date_provisioned field is configured in your last search so that screwed up your days_since_provisioned eval.
I created a date_provisioned field using the convert timeformat=... mktime(_time) as date_provisioned . Then added in the rest of your search with some minor tweaks.
Hope this helps!
... View more