When I use a filter like ‘reported_at > “2 hours ago”’ , the list contains hosts that reported up from now until 2 hours ago, instead of reports that are older than 2 hours. Replacing ‘>’ by ‘<’ gives the desired results
A filter like ‘reported_at > “2 hours ago”’ showing only hosts that have checked in longer than 2 hours ago
That might seem a bit counter-intuitive at first, due to the words. However, behind the scenes “two hours ago” gets translated to a timestamp of two hours before the search query is executed, and you get all hosts who’s “reported_at” field is greater (i.e. newer) than the time it was two hours ago.
Given how many times we saw this confusion, should we update scoped_search so that > is considered < when relative time is used? I know that would change the existing behavior, this is quite confusing for new users.
Ah yes, I see,
maybe we should have our clocks count down from the Big Bang towards the estimated end of a universe that contains light
Although you’d need somewhere around 10 to the power of 30 to the power of 30 digits, just to store the timestamp, maybe not entirely practical…