The problem you’re seeing is your rangemap has overlapping values.
Whereas with the eval format, you’re trimming the ranges "properly" with case.
Sidebar – you can make that case simpler thusly:
| eval size_group = case(SizeInMB < 150, "0-150 MB", SizeInMB < 200, "150-200 MB", SizeInMB < 300, "200-300 MB", SizeInMB < 500, "300-500 MB", SizeInMB < 1000, "500-1000 MB", 0=0, ">1000 MB")
Since case expressions stop evaluating as soon as a match is made, no need to use AND as you’d had it. And using 0=0 for your last possibility will always evaluate true (think of default in case statements in C or C++).
from User warren – Stack Overflow https://stackoverflow.com/questions/67173540/splunk-dashboard-difference-between-eval-case-and-rangemap-result/67179804#67179804
via IFTTT