I am working with Qualys Vulnerability reporting in Splunk and I'm building out a timechart of aging Vulns (Active Vulns that have not been addressed in more than 30 days).
I've got my FIRST_FOUND_DATETIME being imported and I'm performing an offset (FIRST_FOUND< relative_time(now(), "-30d@d") to do a count by SEV.
When I build my timechart though, the readout dates are current dates (indicating that as of TODAY, this is the count of Vulns more than 30 days old). As the builder, this makes sense to me but in presenting to users, I would just like to report it by the FIRST_FOUND dates. Can I offset the x-axis values by the same 30 days I'm offsetting my counts? If so, how?
