How to narrow time frame for metadata search to only see events within a certain window?

[tromero3]

I have a metadata search to detect when host stops sending logs. I'd like to change the timeframe so that I only see the hosts where Last_Time_Reported is between 1 - 90 days ago, I do not want to see anything if last time reported was beyond that. When I change the time picker to 90 days, I am still seeing events way past 90 days prior. So I know that I need to change the query instead but I am not sure what exactly I should add. Can someone please help? Thank you!

| metadata type=hosts index=* | where relative_time(now(), "-1d") > lastTime | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup assets.csv nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit | rename Latest_Time AS "Last Time Reported"

[to4kawa · Accepted solution]

| where relative_time(now(), "-1d") > lastTime AND  lastTime > relative_time(now(), "-90d")  

the hosts where Last_Time_Reported is between 1 - 90 days ago
try this where

[tromero3]

That worked! Thank you!!