Both operators olderThan and newerThan take two arguments; both arguments are converted to Longs and summed. The sum is compared against the current ticks count on the local machine. If one of the arguments is given as a String, it must be convertible to a Date from which a ticks value can be computed.
The S-Expressions used in the queries aren’t a full LISP implementation, so the LISP-y commands won’t be supported by the client. (We just use S-Expressions as the intermediate form because it's a great format for manipulation -- we can inject permissions clauses and perform other non-destructive modifications to the intermediate form without having to parse SQL)
All timestamps (unless documented elsewhere) will be in UTC ticks.
(where (newerThan OrionAuditLog.EndTime 3600000))
This would select records that have ended within the last 1000 hours ( now < EndTime + 3600000 )
(where (olderThan EPOLeafNode.LastUpdate "2012-04-01 00:00:00.000"))
This would select records that were last ended within the last 370351000 hours (probably not what you intended)
To find the nodes that haven’t been updated since April 1st, you would use the olderThanAbsolute operator which takes two args and returns arg1 < arg2.
The documentation of S-expression operators is definitely something we'd look for feedback on ... if people are really drilling into core.executeQuery and building these queries on the fly, maybe it's worth our investing more in that direction. The command core.listDatatypes gives basic info about what operators are available, but doesn't really show you how they're used. I've created more than one query in the UI with some basic values that I could then export to see what expression was created.
Definitely looking to your opinions about where you think we should go here.
Thank you very much for your informative answer. I read it this morning and I've been excited all day about trying to dive a little bittle deeper and figure out some examples that I can post here to help others. However, my day has been jam-packed trying to solve other problems that keep popping up. I'm going to do some work using your suggestions and get back to you with more detail within a few days.