Splunk Search

How can I override or offset the x-axis values in a Timechart?

Explorer

I am working with Qualys Vulnerability reporting in Splunk and I'm building out a timechart of aging Vulns (Active Vulns that have not been addressed in more than 30 days).

I've got my FIRSTFOUNDDATETIME being imported and I'm performing an offset (FIRSTFOUND< relativetime(now(), "-30d@d") to do a count by SEV.

When I build my timechart though, the readout dates are current dates (indicating that as of TODAY, this is the count of Vulns more than 30 days old). As the builder, this makes sense to me but in presenting to users, I would just like to report it by the FIRST_FOUND dates. Can I offset the x-axis values by the same 30 days I'm offsetting my counts? If so, how?

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can try renaming FIRSTFOUNDDATETIME as _time while plotting the timechart.

View solution in original post

SplunkTrust
SplunkTrust

You can try renaming FIRSTFOUNDDATETIME as _time while plotting the timechart.

View solution in original post

Explorer

Perfect. Thanks!

0 Karma