I am trying to create a histogram/distribution graph of deal durations, for comparison between where the user is accessing a website from.
This search works more or less OK:
"search that returns reults with deal durations in field totalTime" | chart count(_raw) as "Num Deals" by totalTime span=100
totalTime is returned as an integer 0-3000, meaning ideally I would have 30 buckets. My problem is that some locations are very slow, and there are no durations below 800. The chart command does not create any rows for durations lower than 800 (ie. 0-100, 100-200, 200-300 etc up to 700-800 are all missing). This makes direct comparisons between graphs difficult, as they do not show the same scale.
Is there any way to force Splunk to create empty buckets (starting from zero) for charting as per my requirement?