LastHostConnectedEventTime Not working as expected

Are you talking about the search filter? Could you post the exact text that isn't behaving as expected?

Not as a search filter, as a session group filter.

For example:

LastHostConnectedEventTime < 2daysago

Should logically filter a group of systems that last had a host connected in the past 2 days (less than 2 days ago).

But this is not what happens when you use this filter to create a session group. Instead, you get nothing, or a list of computers from today...not the last 24 hours.

It seems to be working properly on my 6.9 instance. The $<integer>DAYSAGO variable is interpreted as a date, so the expression you wrote would create a group with all sessions where the last host connection event is earlier than 2 days ago - not in the past two days. (You should use ">" for that.)

So in your case, if all your sessions have had a host connection recently, then it would make sense for the group created by your filter to be empty. (They all have host connection events newer than 2 days ago.)

Does this make sense, and explain what you're observing?

I understand what you mean by the modifier being backwards.

However, when I do that, the group still only contains sessions from the current day, regardless of the integer I put in.

Fixed in 19.2.23810 (in preview as of May 3)