Explanation:
time_since(lastSeen_r, 'days') > 90
: Selects devices that have not been seen for more than 90 days.
online == 'false'
: Filters devices that are currently offline.
.hostname
: Returns only the hostnames.
Important:
This query prevents devices with an old "Last Seen" date, but that are now online, from being included. This way, you focus only on devices that have both not been seen for a long time and are actually offline.
Devices[?time_since(lastSeen_r,
days
) >
90
&& online ==
false
].hostname