Splunk Search

How can I override or offset the x-axis values in a Timechart?

klawman
Explorer

I am working with Qualys Vulnerability reporting in Splunk and I'm building out a timechart of aging Vulns (Active Vulns that have not been addressed in more than 30 days).

I've got my FIRST_FOUND_DATETIME being imported and I'm performing an offset (FIRST_FOUND< relative_time(now(), "-30d@d") to do a count by SEV.

When I build my timechart though, the readout dates are current dates (indicating that as of TODAY, this is the count of Vulns more than 30 days old). As the builder, this makes sense to me but in presenting to users, I would just like to report it by the FIRST_FOUND dates. Can I offset the x-axis values by the same 30 days I'm offsetting my counts? If so, how?

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can try renaming FIRST_FOUND_DATETIME as _time while plotting the timechart.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can try renaming FIRST_FOUND_DATETIME as _time while plotting the timechart.

klawman
Explorer

Perfect. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...