The following Splunk Search (query) is for Qualys and will show a trending over 30 days for re-opened vulnerabilities. This query assumes that your index is defined as qualys.
index=qualys HOSTVULN earliest=-30d@d STATUS="RE-OPENED" | dedup HOST_ID, QID sortby +_time | join HOST_ID | timechart span=1d count(QID) by SEVERITY
* DISCLOSURE* – I did not create this query. That credit goes to Jeff Leggett.