Splunk Search

How can I override or offset the x-axis values in a Timechart?

klawman
Explorer

I am working with Qualys Vulnerability reporting in Splunk and I'm building out a timechart of aging Vulns (Active Vulns that have not been addressed in more than 30 days).

I've got my FIRST_FOUND_DATETIME being imported and I'm performing an offset (FIRST_FOUND< relative_time(now(), "-30d@d") to do a count by SEV.

When I build my timechart though, the readout dates are current dates (indicating that as of TODAY, this is the count of Vulns more than 30 days old). As the builder, this makes sense to me but in presenting to users, I would just like to report it by the FIRST_FOUND dates. Can I offset the x-axis values by the same 30 days I'm offsetting my counts? If so, how?

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You can try renaming FIRST_FOUND_DATETIME as _time while plotting the timechart.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You can try renaming FIRST_FOUND_DATETIME as _time while plotting the timechart.

klawman
Explorer

Perfect. Thanks!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...