Add 0 Count

It would be nice if you could just have a command called like generateRows rows=N that would generate a result set with N rows.

However we can hack one together ourselves using a search for the 1000 most recent events in the last 30 days.

<search terms> | stats count by functionDuration | append [| search index=* OR index=_internal earliest=-30d | head 1000 | fields - * | fields - _* | streamstats count | rename count as functionDuration | eval count=0] | stats sum(count) as count by functionDuration | sort functionDuration

The basic idea is, use our weird subsearch hack to append 1000 rows, with every functionDuration value from 1-1000 represented. Then when we wash the original "real" events together with the fake events, through `| stats sum(count) as count by functionDuration), suddenly we'll have every functionDuration value from 1-1000 represented...

Alternates: 1) Instead of the weird index=* OR index=_* search, you could also just use a csv in /var/run/dispatch that has 1000 rows in it.
2) Or you could do the trick in that other answer, where you do | eval foo="1,2,3,4,5,6,7,8,..." | eval foo=split(foo,",") | mvexpand foo, but I'm not sure those commands will be overjoyed at expanding out to thousands of rows... You might hit a limit around 100 or a couple hundred.

Maybe this one could help with some inspiration? Include zero count in stats count on Splunk Answers