Problems using where command to compare times and filter results

[rjashton]

I'm having trouble with using the where command to compare times. The search that I'm running is this:

index=jamf sourcetype=JamfModularInput "computer.general.last_contact_time_epoch"=* "computer.general.last_contact_time_epoch"!=0| dedup computer.pagination.serial_number 
| rename computer.general.last_contact_time_epoch as checkinepoch  
| eval thirtydays=relative_time(now(),"-30d")
| rename computer.general.last_contact_time as "Last Check-In"
| where "thirtydays">"checkinepoch" 
| table thirtydays,checkinepoch,"Last Check-In"

The problem I have is that it returns no results with the where command being using less than (<), and then if I use greater than (>) it returns all of the results without filtering the ones that I want. Here is an example of the output with that search:
As you can see I am getting results returned where checkinepoch is larger than thirtydays.

Does the where command treat the decimal in the thirtydays number as a multiplation operator (like x*y = xy)? The effect of this could be that it calculates that value as 1634051921 * 000000 = 0 

Super confused by this 😄 please help!

[ITWhisperer · Accepted solution]

Your epoch time is in milliseconds and your thirtydays is in seconds which is a factor of 1000 different - either multiply or divide one of them to get to the same units.

[rjashton]

I knew I was doing something pretty silly but I just couldn't see! Thanks very much!